Re-design of the original gocryptfs code to work as a library.
Go to file
Jakob Unterwurzacher 76311b60f2 Add file header (on-disk-format change)
Format: [ "Version" uint16 big endian ] [ "Id" 16 random bytes ]

Quoting SECURITY.md:

* Every file has a header that contains a 16-byte random *file id*
* Each block uses the file id and its block number as GCM *authentication data*
 * This means the position of the blocks is protected as well. The blocks
   can not be reordered or copied between different files without
   causing an decryption error.
2015-11-01 01:38:27 +01:00
cryptfs Add file header (on-disk-format change) 2015-11-01 01:38:27 +01:00
openssl_benchmark Run go fmt 2015-10-07 22:59:36 +02:00
pathfs_frontend Add file header (on-disk-format change) 2015-11-01 01:38:27 +01:00
.gitignore Move main files to top level dir 2015-10-11 17:14:18 +02:00
.travis.yml Add travis config file 2015-10-11 23:55:47 +02:00
benchmark.bash Fix helper scripts for new top-level path 2015-10-11 18:40:27 +02:00
build.bash Move main files to top level dir 2015-10-11 17:14:18 +02:00
checkdir.go Run gofmt 2015-10-11 18:51:56 +02:00
daemonize.go Run gofmt 2015-10-11 18:51:56 +02:00
LICENSE Add MIT LICENSE 2015-10-11 23:15:03 +02:00
main_test.go tests: introduce verifySize() for detailed error messages 2015-11-01 01:36:20 +01:00
main.go Run gofmt 2015-10-11 18:51:56 +02:00
masterkey.go Move main files to top level dir 2015-10-11 17:14:18 +02:00
package.bash Fix helper scripts for new top-level path 2015-10-11 18:40:27 +02:00
password.go Move main files to top level dir 2015-10-11 17:14:18 +02:00
README.md Add file header (on-disk-format change) 2015-11-01 01:38:27 +01:00
SECURITY.md Add file header (on-disk-format change) 2015-11-01 01:38:27 +01:00
sendusr1.go Rename sendSig to sendUsr1 2015-10-11 18:01:47 +02:00
test.bash tests: run unit tests before integration tests 2015-11-01 01:36:20 +01:00
XFSTESTS.md Fix link in XFSTESTS.md 2015-10-11 23:18:02 +02:00

GoCryptFS Build Status

An encrypted overlay filesystem focused on security and correctness.

gocryptfs is built on top the excellent go-fuse FUSE library and its LoopbackFileSystem API.

This project was inspired by EncFS and strives to fix its security issues (see EncFS tickets 9, 13, 14, 16). For details on the security of GoCryptFS see the SECURITY.md document.

Current Status

  • First public release
  • Feature-complete
  • Passes the fuse-xfstests "generic" tests with one exception, results: XFSTESTS.md
  • A lot of work has gone into this. The testing has found bugs in gocryptfs as well as in go-fuse.
  • The one exceptions generic/035. This is a limitation in go-fuse, check out https://github.com/hanwen/go-fuse/issues/55 for details.
  • However, gocryptfs needs more real-world testing - please report any issues via github.
  • Only Linux operation has been tested. Help wanted for a Mac OS X port.

Install

$ go get github.com/rfjakob/gocryptfs

Use

$ mkdir cipher plain
$ $GOPATH/bin/gocryptfs --init cipher
  [...]
$ $GOPATH/bin/gocryptfs cipher plain
  [...]
$ echo test > plain/test.txt
$ ls -l cipher
  total 8
  -rw-rw-r--. 1 user  user   33  7. Okt 23:23 0ao8Hyyf1A-A88sfNvkUxA==
  -rw-rw-r--. 1 user  user  233  7. Okt 23:23 gocryptfs.conf
$ fusermount -u plain

Performance

  • 28 bytes of storage overhead per block (16 bytes auth tag, 12 byte nonce)
  • uses openssl through spacemonkeygo/openssl for a 3x speedup compared to crypto/cipher (see go-vs-openssl.md for details

Run ./benchmark.bash to run the test suite and the streaming read/write benchmark. The benchmark is run twice, first with native Go crypto and second using openssl.

The output should look like this:

$ ./benchmark.bash
[...]
BenchmarkStreamWrite	     100	  11816665 ns/op	  88.74 MB/s
BenchmarkStreamRead 	     200	   7848155 ns/op	 133.61 MB/s
ok  	github.com/rfjakob/gocryptfs	9.407s

Changelog

v0.3 (in progress)

  • Add file header that contains a random id to authenticate blocks
  • This is an on-disk-format change

v0.2

  • Replace bash daemonization wrapper with native Go implementation
  • Better user feedback on mount failures

v0.1

  • First release

See https://github.com/rfjakob/gocryptfs/releases for the release dates and associated tags.