hardcoresushi/libgocryptfs
1
0
Fork 0
Code Issues Pull Requests Releases Activity
Re-design of the original gocryptfs code to work as a library.
61 Commits 2 Branches 0 Tags 6 MiB
Go 93.7%
C 4.3%
Shell 1.7%
Makefile 0.3%
40448db909
Go to file
Jakob Unterwurzacher 40448db909 Fix xfstests generic/030 failure 
The actual fix is

	oldSize := f.cfs.PlainSize(uint64(fi.Size()))

the rest is logging improvements
2015-10-04 00:26:20 +02:00
cluefs_frontend Encrypt key with scrypt-hashed password 2015-09-13 22:09:38 +02:00
cryptfs Fix xfstests generic/030 failure 2015-10-04 00:26:20 +02:00
openssl_benchmark readme: link to go-vs-openssl.md 2015-09-06 13:13:47 +02:00
pathfs_frontend Fix xfstests generic/030 failure 2015-10-04 00:26:20 +02:00
.gitignore Add pathfs frontend (uses go-fuse instead of bazil-fuse), part I 2015-09-08 00:55:03 +02:00
gocryptfs.sh Add daemonization shell script 2015-10-03 19:17:31 +02:00
main_benchmark.bash Add streaming read and write benchmarks 2015-09-06 11:42:01 +02:00
main_test.go tests: Add append test 2015-09-30 23:42:18 +02:00
main.go Set Fileystem and Type values shown in "df -T" and friends 2015-09-19 10:47:16 +02:00
README.md Explain both frontends in readme 2015-09-08 23:09:28 +02:00

README.md

GoCryptFS

A minimal encrypted overlay filesystem written in Go.

Inspired by EncFS.

GoCryptFS at the moment has two FUSE frontends:

A frontend is selected on compile-time by setting USE_CLUEFS to true or false (default false). Once I decide that one works better for GoCryptFS, the other one will go away.

Design

  • Authenticated encryption of file contents using AES-GCM-128
  • Because GCM handles blocks of arbitrary size, there is no special handling for the last file block
  • 4096 byte blocks per default
  • 28 bytes of overhead per block (16 bytes auth tag, 12 byte nonce)
  • uses openssl through spacemonkeygo/openssl for a 3x speedup compared to crypto/cipher (see go-vs-openssl.md) for details
  • Per-write unique 96 bit nonces
  • starts from a random value (generated at mount time) and counts up
  • Flename encryption using AES-CBC-128
  • Padded to 16-byte blocks acc. to RFC5652 section 6.3
  • base64 encoded acc. to RFC4648 section 5

Current Status

Not ready for anything but testing and debugging

  • File and directory creation and deletion works
  • Thread-safe nonce generation works
  • Filename and content encryption works
  • Key is set to static all-zero
  • Reading and writing works
  • Streaming performance is already reasonable
  • But we should be able to get another 50% speedup
  • Symlinks and hard links not yet implemented
  • Memory usage is insane

Install

go get github.com/rfjakob/gocryptfs

Testing

Run ./main_benchmark.bash to run the test suite and the streaming read/write benchmark.

The output should look like this:

$ ./main_benchmark.bash
+ go build
+ go test -bench=.
PASS
BenchmarkStreamWrite	     100	  14062281 ns/op	  74.57 MB/s
BenchmarkStreamRead 	     100	  11267741 ns/op	  93.06 MB/s
ok  	github.com/rfjakob/gocryptfs	7.569s