According to documentation, I simply create a public/private keypair for ecryptfs
using ecryptfs-manager
. But there is nothing to select.
$ sudo ecryptfs-manager
eCryptfs key management menu
-------------------------------
1. Add passphrase key to keyring
2. Add public key to keyring
3. Generate new public/private keypair
4. Exit
Make selection: 3
Select key type to use for newly created files:
Selection:
There should at least one option for me to select, sorta like this:
Make selection: 3
Select key type to use for newly created files:
1. OpenSSL
2. Probably some other option here
Selection:
I am using Ubuntu 11.10 (with Xubuntu-desktop). I have all relevant packages AFAIK like ecryptfs-utils, openssl, keyutils. What am I missing?
Although I can create a key pair using openssl
like so (I am not sure this is right for use with ecryptfs
):
$ openssl genrsa -out rsakey.pem -aes256 2048
Generating RSA private key, 2048 bit long modulus
(...)
Enter pass phrase for rs-efs-rsakey.pem:
Verifying - Enter pass phrase for rs-efs-rsakey.pem:
$ openssl rsa -in rsakey.pem -out rsapub.pem -pubout
Enter pass phrase for rsakey.pem:
writing RSA key
There is still a problem with ecryptfs
because just like ecryptfs-manager
, mount -t ecryptfs
also misses the option to choose for keys.
When I mount something random, I get:
$ sudo mount -t ecryptfs ~/temp ~/temp
[sudo] password for redsandro:
Passphrase:
It immediately assumes I want to use password encryption. What I should have gotten is something like this:
$ sudo mount -t ecryptfs ~/temp ~/temp
[sudo] password for redsandro:
Select key type to use for newly created files:
1) openssl
2) passphrase
3) tspi
Selection:
I am guessing the same [something] is missing for ecryptfs-manager
and mount
, because the same question is present in documentation. What am I missing?
You're not missing anything. Ubuntu, and other distros, could not ship the OpenSSL key module due to licensing issues with the GPLv2-licensed libecryptfs.
The copyright holders to the OpenSSL key module recently added an exception that should allow distros to ship the OpenSSL key module.
You can probably expect the key module to show up in the Ubuntu release after the 12.04 release. Note that the time frame is still undecided.
In the meantime, you could compile ecryptfs-utils yourself and copy the libecryptfs_key_mod_openssl.so to the appropriate location (likely /usr/lib/ecryptfs/). If you decide to do that, please keep in mind that it is not tested and you will be unsupported.