hardcoresushi/libgocryptfs
1
0
Fork 0
Code Issues Pull Requests Releases Activity
Re-design of the original gocryptfs code to work as a library.
159 Commits 2 Branches 0 Tags 6 MiB
Go 93.7%
C 4.3%
Shell 1.7%
Makefile 0.3%
b06c1ebfc4
Go to file
Jakob Unterwurzacher b06c1ebfc4 Revert "Travis CI: build using build.bash" 
Build fails, see https://github.com/hanwen/go-fuse/pull/72 for details

This reverts commit 4637098b20.
2015-11-14 18:27:06 +01:00
cryptfs Run go fmt and go vet 2015-11-14 17:16:17 +01:00
integration_tests Run go fmt and go vet 2015-11-14 17:16:17 +01:00
openssl_benchmark Run go fmt 2015-10-07 22:59:36 +02:00
pathfs_frontend Run go fmt and go vet 2015-11-14 17:16:17 +01:00
.gitignore Add MANPAGE.md and MANPAGE-render.bash 2015-11-11 09:15:14 +01:00
.travis.yml Revert "Travis CI: build using build.bash" 2015-11-14 18:27:06 +01:00
benchmark.bash tests: move integration tests to separate directory 2015-11-12 21:02:44 +01:00
build.bash Bake version string into binary, add "--version" switch 2015-11-01 14:04:29 +01:00
checkdir.go Fix missing printf arguments discovered by "go vet" 2015-11-01 11:56:33 +01:00
daemonize.go Use new arg "-notifypid" for more robust daemonization 2015-11-09 23:33:35 +01:00
LICENSE Add MIT LICENSE 2015-10-11 23:15:03 +02:00
main.go Run go fmt and go vet 2015-11-14 17:16:17 +01:00
MANPAGE-render.bash Add MANPAGE.md and MANPAGE-render.bash 2015-11-11 09:15:14 +01:00
MANPAGE.md README: Add link to MANPAGE 2015-11-11 09:21:32 +01:00
masterkey.go Also hide master key reminder with "-q" 2015-11-09 23:33:35 +01:00
package.bash package.bash: add architecture to filename 2015-11-01 15:33:54 +01:00
password.go Also hide master key reminder with "-q" 2015-11-09 23:33:35 +01:00
README.md README: Add link to MANPAGE 2015-11-11 09:21:32 +01:00
SECURITY.md Add file header (on-disk-format change) 2015-11-01 01:38:27 +01:00
sendusr1.go Use new arg "-notifypid" for more robust daemonization 2015-11-09 23:33:35 +01:00
test.bash tests: move integration tests to separate directory 2015-11-12 21:02:44 +01:00
TODO.md Use new arg "-notifypid" for more robust daemonization 2015-11-09 23:33:35 +01:00
XFSTESTS.md Fix link in XFSTESTS.md 2015-10-11 23:18:02 +02:00

README.md

GoCryptFS Build Status

An encrypted overlay filesystem written in Go.

gocryptfs is built on top the excellent go-fuse FUSE library and its LoopbackFileSystem API.

This project was inspired by EncFS and strives to fix its security issues (see EncFS tickets 9, 13, 14, 16). For details on the security of gocryptfs see the SECURITY.md document.

Current Status

  • Feature-complete and working
  • Passes the fuse-xfstests "generic" tests with one exception, results: XFSTESTS.md
  • A lot of work has gone into this. The testing has found bugs in gocryptfs as well as in go-fuse.
  • The one exception is generic/035. This is a limitation in go-fuse, check out https://github.com/hanwen/go-fuse/issues/55 for details.
  • However, gocryptfs needs more real-world testing - please report any issues via github.
  • Only Linux operation has been tested. Help wanted for Mac OS X verification.

Install

$ go get github.com/rfjakob/gocryptfs

Use

Quickstart:

$ mkdir cipher plain
$ $GOPATH/bin/gocryptfs --init cipher
  [...]
$ $GOPATH/bin/gocryptfs cipher plain
  [...]
$ echo test > plain/test.txt
$ ls -l cipher
  total 8
  -rw-rw-r--. 1 user  user   33  7. Okt 23:23 0ao8Hyyf1A-A88sfNvkUxA==
  -rw-rw-r--. 1 user  user  233  7. Okt 23:23 gocryptfs.conf
$ fusermount -u plain

See MANPAGE.md for a description of available options.

Storage Overhead

  • Empty files take 0 bytes on disk
  • 18 byte file header for non-empty files (2 bytes version, 16 bytes random file id)
  • 28 bytes of storage overhead per 4kB block (12 byte nonce, 16 bytes auth tag)

Performance

Run ./benchmark.bash to run the test suite and the streaming read/write benchmark. The benchmark is run twice, first with native Go crypto and second using openssl.

The output should look like this:

$ ./benchmark.bash
[...]
BenchmarkStreamWrite	     100	  11816665 ns/op	  88.74 MB/s
BenchmarkStreamRead 	     200	   7848155 ns/op	 133.61 MB/s
ok  	github.com/rfjakob/gocryptfs	9.407s

Changelog

v0.4 (in progress)

  • Add --plaintextnames command line option
  • Can only be used in conjunction with --init and disables filename encryption (added on user request)
  • Add FeatureFlags config file paramter
  • This is a config format change, hence the on-disk format is incremented
  • Used for ext4-style filesystem feature flags. This should help avoid future format changes.
  • On-disk format 2

v0.3

  • Add file header that contains a random id to authenticate blocks
  • This is an on-disk-format change
  • On-disk format 1

v0.2

  • Replace bash daemonization wrapper with native Go implementation
  • Better user feedback on mount failures

v0.1

  • First release
  • On-disk format 0

See https://github.com/rfjakob/gocryptfs/releases for the release dates and associated tags.