1
\documentclass{article}
5
\newcommand{\currentversion}{0.1}
9
\title{The Beginners Guide to eCryptfs \currentversion}
11
\author{Michael C. Thompson}
15
\section*{Introduction - So What Is This eCryptfs Thing Anyways?}
17
eCryptfs is a stacked filesystem which allows you to have encrypted files on
18
your hard drive without having to reformat. eCryptfs being a stack file system
19
means that in order to mount eCryptfs, all you need is an existing host
20
directory on an existing filesystem, which will be where eCryptfs stores the
21
encrypted versions of your files, and an existing target directory, which will
22
be the eCryptfs mount point and the window through which you can access your
25
\section*{How eCryptfs Uses Your Existing Filesystem}
27
You can imagine using eCryptfs as a three layered system. The bottom most
28
layer is your hard drive. The middle layer is a formatted filesystem of your
29
choice (say ext3). The top layer is of course eCryptfs, which uses two
30
directories in the filesystem, one for the eCryptfs encrypted data (the
31
**host** directory), and one for the decrypted view of that data (the **target**
32
directory). These two directories will parallel each other in structure since
33
the **target** directory is the decrypted view of the **host** directory.
35
\section*{Mounting eCryptfs}
37
eCryptfs is currently under development, with future versions being
38
backwards compatable. Currently, eCryptfs is in version 0.1, and you can
39
read about the various ways eCryptfs can be mounted in the appropriate
42
\subsection*{Mounting eCryptfs v0.1}
44
eCryptfs v0.1 currently supports only one authentication option: mount-wide
45
passphrase. This is provided as the mount option "-o passphrase=12345abcde"
46
Additional parameters to this are as follows:
47
-o salt=1234567890abcdef
49
\section*{Writing Data And Getting It Back}
51
As stated in the previous section, there are two directories which eCryptfs
52
uses on your file system, the **host** directory and **target** directory.
53
The **host** directory is only used to store the encrypted versions of the
54
files you make through eCryptfs, you should not access these files directly,
55
as changing them will break them!
57
The **target** directory is where you will want to do your work, because that
58
provides the layer of eCryptfs functionality which will handle all of the
59
encryption and decryption of files automatically.
61
Inside the **target** directory, you can do a simple test to make sure that
62
what you write, is what you'll get back. Here is an example:
63
\# echo "This is my eCryptfs read/write test" > file
66
You should get back what you wrote. That is all there is to it.
68
\section*{Cryptographic Operations - How eCryptfs Does Its Magic}
70
eCryptfs uses multiple layers of encryption to protect the confidentiality of
71
your data. Each file is stored as a string of blocks on the hard drive (usually about 4K in size), and each of these blocks in the file, which will vary
72
based on the size of the file, is individually encrypted with a common special
73
key that is generated randomly for each file. That randomly generated key
74
which was used to encrypt the data is then encrypted by a secret (such as a
75
different key or passphrase) you provide, and written to disk. This allows
76
you to retrieve the key used to encrypt the data when it is time to decrypt,
77
and if your key or passphrase is truly secret, your data can only be
80
\subsection*{Using Mount-Wide Passphrase}
82
Mount-wide passphrase was introduced in eCryptfs version 0.1. For more
83
information on using this to encrypt your data, see the
84
"Mounting eCryptfs v0.1" section for details.
86
Mount-wide passphrase is exactly as it sounds, when you mount eCryptfs, you
87
provide it with a single passphrase which is then used to encrypt all new
88
files you create, as well as used when you try to open any existing files.
89
It is highly advised that you also provide a salt along with the password,
90
which will help make an attack against your files harder than if you use
93
\section*{File Format \& Other Detailed Information}
95
If you would like to know more details about how eCryptfs works, please
96
consult the design documentation which should be coupled with the
99
\begin{thebibliography}{1}
102
\url{http://www.linuxsymposium.org/2006/proceedings.php}.
103
\bibitem{designdoc} See
104
ecryptfs/doc/design\_doc/ecryptfs\_design\_doc.tex
106
\end{thebibliography}
added
removed
doc/beginners_guide/ecryptfs_beginners_guide.tex
