Home / server / Questions / 403820
Accepted
HappyDeveloper
Asked: 2012-07-01 19:02:10 +0800 CST

Changed encfs password, but filenames didn't change

  • 772

I thought changing the password with 'encfsctl passwd path/to/encrypted' would change all filenames. But it didn't work. Any ideas why?

I got this, so the password was changed correctly:

Enter current Encfs password
EncFS Password:
Enter new Encfs password
New Encfs Password:
Verify Encfs Password:
Volume Key successfully updated.
encryption

2 Answers

  1. Best Answer

    Data encryption systems (typically) do not directly encrypt the data with the password. The problem with doing this is that when the password is changed, all the data needs to be re-encrypted, which is a very intensive process. (It also prevents supporting multiple passwords.) Instead, a random key is generated when the system is initialised, and the data is encrypted with this random key. The random key is then encrypted with the password and stored on disk. To decrypt the data the password is first used to decrypt the random key, and then the random key is used to decrypt the data. Changing the password simply involves re-encrypting this random key, and not all the data.

    The encfs manpage mentions:

    The user must supply a password which is used to (indirectly) encrypt both filenames and file contents.

    which implies that it uses this scheme.

    • 9

  2. In EncFS the filenames and the data have different initialisation vectors. That prevents an attacker from encrypting data (or filenames) and compare it to the cypthertext.

    As mentioned in the default answer, the password is actually only used to encrypt the Key. And the Key is used to encrypt the data. So assuming you changed the password you can reencrypt all the data inside of the container. Eg. like this (if your containter that contains the decrypted files is ~/dec/ )

    cd ~/dec/
mkdir _copy
cp -a ./ ./_copy/
mv ./_copy/* ./
    • 0