1
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
11
<h3>An Enterprise-class Cryptographic Filesystem for Linux</h3>
15
<a href="#download">Download</a>
16
| <a href="#overview">Overview</a>
17
| <a href="#announcements">Announcements</a>
18
| <a href="#documentation">Documentation</a>/<a href="ecryptfs-faq.html">FAQ</a>
19
| <a href="#mailing_lists">Mailing Lists</a>
20
| <a href="#credits">Credits</a>
21
| <a href="http://www.sourceforge.net/projects/ecryptfs">SourceForge Page</a>
31
<p>You can get eCryptfs in a number of ways. eCryptfs consists of two
32
components: the kernel module and the userspace code. You need
37
href="http://sourceforge.net/project/showfiles.php?group_id=133988&package_id=149785">userspace
38
utilities</a>; you have two options:</li>
40
<li>Download, build, and install the <a
41
href="http://sourceforge.net/project/showfiles.php?group_id=133988&package_id=149785&release_id=320216">ecryptfs-utils</a>
42
tarball (follow the installation and usage instructions in the README
44
<li>Install the ecryptfs-utils package for your distribution.</li>
46
<li>eCryptfs kernel module; you have three options:</li>
48
<li>Use the latest release of the Linux kernel.</li>
50
<li>Download and build the <a
51
href="http://sourceforge.net/project/showfiles.php?group_id=133988&package_id=198555">
52
full eCryptfs package containing both the kernel and the userspace
53
components</a>. We supply these packages primarily for convenience;
54
the stand-alone module code is not as actively maintained as the code
55
in the official Linux kernel. In general, we recommend that you use
56
eCryptfs that ships in the most recent official Linux kernel
59
<li>Download an eCryptfs binary kernel module package for your
64
<p>Note that the eCryptfs SourceForge CVS repository rarely contains
65
up-to-date code. Work from the latest tarball releases instead. Active
66
development on both the eCryptfs <a
67
href="http://git.kernel.org/?p=linux/kernel/git/mhalcrow/ecryptfs.git;a=summary">kernel
68
module</a> and the eCryptfs <a
69
href="http://git.kernel.org/?p=linux/kernel/git/mhalcrow/ecryptfs-utils.git;a=summary">userspace
70
utilities</a> takes place via the kernel.org GIT repository.</p>
76
href="http://www.sourceforge.net/projects/ecryptfs">SourceForge
77
page</a>) is a POSIX-compliant enterprise-class stacked cryptographic
78
filesystem for Linux. It is derived from Erez Zadok's Cryptfs,
79
implemented through the FiST framework for generating stacked
80
filesystems. eCryptfs extends Cryptfs to provide advanced key
81
management and policy features. eCryptfs stores cryptographic metadata
82
in the header of each file written, so that encrypted files can be
83
copied between hosts; the file will be decryptable with the proper
84
key, and there is no need to keep track of any additional information
85
aside from what is already in the encrypted file itself. Think of
86
eCryptfs as a sort of ``gnupgfs.''</p>
88
<p>eCryptfs is a native Linux filesystem (other popular cryptographic
89
filesystems for Linux require FUSE or operate via RPC calls). The
90
kernel module component of eCryptfs is upstream in the Linux
93
<p>eCryptfs is undergoing a staged feature release process:</p>
96
<li>Mount-wide passphrase, specified at mount time (<font color=#0000ff>complete</font>)</li>
97
<li>Encryption/decryption support (<font color=#0000ff>complete</font>)</li>
98
<li>Add cipher selection support (<font color=#0000ff>complete</font>)</li>
99
<li>Add mount-wide public key support, specified at mount time (<font color=#0000ff>complete</font>)</li>
100
<li>Storage of metadata in file extended attribute region (<font color=#0000ff>complete</font>)</li>
101
<li>PAM module (<font color=#0000ff>complete</font>)</li>
102
<li>Multiple keys per inode (<font color=#0000ff>complete</font>)</li>
103
<li>TPM key module (<font color=#0000ff>complete</font>)</li>
104
<li>PKCS#11 key module (<font color=#0000ff>complete</font>)</li>
105
<li>Integrity verification (<font color=#00ff00>in progress; preliminary patch <a href="http://downloads.sourceforge.net/ecryptfs/ecryptfs-hmac-2.6.24-rc5-2.txt">here</a></font>)</li>
106
<li>Filename encryption support (<font color=#00ff00>in progress; preliminary patch <a href="http://downloads.sourceforge.net/ecryptfs/ecryptfs-filename-crypto-2.6.27-rc7-20081103.txt">here</a></font>)</li>
107
<li>GnuPG key module (in plan)</li>
108
<li>Dynamic policy support (in plan)</li>
111
<p>To use eCryptfs, I recommend that you perform an overlay mount. You
112
can do this on any existing installed system by creating a directory
113
for your encrypted files and then by mounting that directory as an
114
eCryptfs filesystem:</p>
119
mount -t ecryptfs /secret /secret
123
<p>The eCryptfs mount helper will ask you a few questions about what
124
key you want to use, what cipher you want to use, and so forth. Once
125
mounted, you can read and write to <code>/secret</code>, and your
126
files will be encrypted on disk. Also, make sure that you use dm-crypt
127
with a random key at boot on any swap space you may be using. See the
128
<a href="http://www.linuxjournal.com/article/9400">Linux Journal
129
article</a> for some more details on this process.</p>
131
<a name="announcements">
133
<h3>Announcements</h3>
136
<li>November 3, 2008</li>
138
<li>eCryptfs mount-on-login has been integrated as a major new <a
139
href="https://wiki.ubuntu.com/EncryptedPrivateDirectory">feature</a>
140
in Ubuntu Intrepid.</li>
141
<li>The primary administrative site for eCryptfs is now hosted from <a
142
href="https://launchpad.net/ecryptfs">Launchpad</a>.</li>
144
href="http://downloads.sourceforge.net/ecryptfs/ecryptfs-filename-crypto-2.6.27-rc7-20081103.txt">Patches
145
providing filename encryption support</a> are being prepared for
146
upstream submission.</li>
151
<li>April 6, 2008</li>
153
<li>The netlink interface with the userspace daemon broke somewhere
154
between 2.6.23 and 2.6.24. <a
155
href="http://downloads.sourceforge.net/ecryptfs/ecryptfs-procfs-kernel-20080406.txt">This
156
patch</a> migrates to a procfs handle instead, bringing back public
157
key functionality for 2.6.24 and later kernel releases. Until the next
158
ecryptfs-utils release, grab the version in the kernel.org <a
159
href="http://git.kernel.org/?p=linux/kernel/git/mhalcrow/ecryptfs-utils.git;a=summary">GIT
165
<li>September 15, 2007</li>
167
<li>Direct access to the address space maintained by another
168
filesystem can cause problems due to unintended interactions between
169
the owning filesystem and the process making changes. eCryptfs now
170
keeps a persistent lower file for each eCryptfs inode. This means that
171
eCryptfs no longer needs to directly access the lower inode's address
172
space in order to do I/O on the lower files. This helps bring eCryptfs
173
closer to functioning well on networked filesystems like NFS, CIFS,
175
href="http://sourceforge.net/project/showfiles.php?group_id=133988&package_id=200455&release_id=438884">experimental</a>
176
section contains a release with this feature implemented. Patches for
177
the -mm tree are complete and under test and review.</li>
182
<li>August 21, 2007</li>
184
<li>ecryptfs-utils version 23 now contains TPM support. You can
185
generate a key bound to certain PCR's and mount eCryptfs against that
186
key. Any files you create from that point on will only be accessible
187
if your PCR values match. You can use this feature to make certain
188
files only decryptable if your machine is booted into a trusted
189
configuration; you do not need to remember or provide any additional
190
secret values for this to work. Think of this as a method for making
191
your existing authentication mechanism on your machine useful for
192
regulating access to files on secondary storage devices, even when the
193
storage device is accessed directly. This provides strong protection
194
against someone booting your computer from a bootable CD and accessing
195
your files, for instance.</li>
200
<li>July 19, 2007</li>
202
<li>Multi-key support patches sent to the LKML.</li>
207
<li>March 15, 2007</li>
209
<li>The April 2007 edition of Linux Journal has an <a
210
href="http://www.linuxjournal.com/article/9400">article</a> on
211
eCryptfs. It is on page 54 of the print edition.</li>
215
<a name="documentation">
216
<h3>Documentation</h3>
218
<p>See the <a href="README">README</a> that is distributed with the
221
<p>Read the <a href="ecryptfs-faq.html">FAQ</a>.</p>
223
<p>Read the <a href="ecryptfs-article.pdf">article</a> on
224
eCryptfs. The content of this article was originally published in the
225
April 2007 edition of Linux Journal magazine. This article is now part
226
of the eCryptfs documentation.</p>
228
<p>Read the <a href="ecryptfs-pam-doc.txt">guide</a> on setting up a
229
wrapped passphrase PAM mount.</p>
231
<p>Read the <a href="ecryptfs.pdf">2005 Ottawa Linux Symposium
232
paper</a> on eCryptfs.</p>
234
<p>Read the original <a href="ecryptfs_design_doc_v0_1.pdf">design
235
document</a> detailing cryptographic properties of eCryptfs. Note
236
that, due to the nature of the Linux kernel development process, the
237
actual implementation may change at any time. Consult the source code
238
directly to get an accurate understanding of exactly what eCryptfs
241
<a name="mailing_lists">
242
<h3>Mailing Lists</h3>
244
<p>Subscribe to the <a
245
href="http://lists.sourceforge.net/lists/listinfo/ecryptfs-users">ecryptfs-users</a>
247
href="http://lists.sourceforge.net/lists/listinfo/ecryptfs-devel">ecryptfs-devel</a>
253
<p><a href="http://halcrow.us/mike.html">Michael Halcrow</a> is the
256
<p>Michael Thompson is a developer.</p>
258
<p><a href="http://hellewell.homeip.net/phillip/">Phillip
259
Hellewell</a> is the project maintainer.</p>
261
<p>Erez Zadok and his research team authored and maintain Cryptfs,
262
which is the basis from which eCryptfs was developed.</p>
264
<p>Many folks have contributed time and resources toward helping
265
eCryptfs become what it is today. These include Steve French (CIFS),
266
David Kleikamp (JFS), and many folks on various mailing lists.</p>
269
<td width="356" valign="top">
270
<img src="ecryptfs-key-diagram-356.png" />
275
<br><br><br><br><br><br><br><br><br><br><br><br><br><br>
276
<br><br><br><br><br><br><br><br><br><br><br><br><br><br>
277
<br><br><br><br><br><br><br><br><br><br><br><br><br><br>
278
<br><br><br><br><br><br><br><br><br><br><br><br><br><br>
added
removed
doc/sourceforge_webpage/index.html
