45 lines
1.4 KiB
Markdown
45 lines
1.4 KiB
Markdown
GoCryptFS Security
|
|
==================
|
|
|
|
Master Key Storage
|
|
------------------
|
|
|
|
The master key is used to perform content and file name encryption.
|
|
It is stored in `gocryptfs.conf`, encrypted with AES-256-GCM using the
|
|
Key Encryption Key (KEK).
|
|
|
|
The KEK is generated from the user password using `scrypt`.
|
|
|
|
|
|
|
|
File Contents
|
|
-------------
|
|
|
|
All file contents are encrypted using AES-256-GCM.
|
|
|
|
Files are segmented into 4KB blocks. Each block gets a fresh random
|
|
96 bit IV each time it is modified. A 128-bit authentication tag (GHASH)
|
|
protects each block from modifications.
|
|
|
|
Each file has a header containing a random 128-bit file ID. The
|
|
file ID and the block number are mixed into the GHASH as
|
|
*additional authenticated data*. The prevents blocks from being copied
|
|
between or within files.
|
|
|
|
|
|
|
|
To support sparse files, all-zero blocks are accepted and passed through
|
|
unchanged.
|
|
|
|
File Names
|
|
----------
|
|
|
|
Every directory gets a 128-bit directory IV that is stored in each
|
|
directory as `gocryptfs.diriv`.
|
|
|
|
File names are encrypted using AES-256-CBC with the directory IV as
|
|
initialization vector. The Base64 encoding limits the usable filename length
|
|
to 176 characters.
|
|
|
|
|