linux-kernel - Re: ecryptfs is unmaintained and untested

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6199587.lOV4Wx5bFT@laptop>
Date: Tue, 14 Oct 2025 18:52:08 +0200
From: Martin Steigerwald <martin@...htvoll.de>
To: John Stultz <jstultz@...gle.com>, Theodore Ts'o <tytso@....edu>
Cc: Arnd Bergmann <arnd@...db.de>, Matthew Wilcox <willy@...radead.org>,
 Arnd Bergmann <arnd@...nel.org>, Tyler Hicks <code@...icks.com>,
 Damien Le Moal <damien.lemoal@...nsource.wdc.com>, ecryptfs@...r.kernel.org,
 linux-kernel@...r.kernel.org
Subject: Re: ecryptfs is unmaintained and untested

Hi.

Theodore Ts'o - 14.10.25, 16:39:16 CEST:
> This is probably because for many desktop and server configurations,
> using dm-crypt is actually better suited and more secure.  It
> certainly doesn't solve the "just encrypt a directory hierarchy in a
> file system" and the "support multiple users' who might have different
> encryption keys and which are mutually suspicious" use cases.  But
> this appears to not be sufficiently interesting for distributions to
> do that integration work.

If it is just about encrypting a sub directory of the home directory there 
has been work to support that on Plasma desktop via Plasma Vault. It 
supports CryFS as default, EncFS (with a security warning about it) and 
gocryptfs. CryFS is interesting as it also obfuscates the directory 
hierarchy as well as object names. All of them are FUSE filesystems.

Maybe one of these – excluding EncFS – could be used for encrypting the 
complete home directory of a user. Preferably CryFS maybe. But I bet it 
will be quite a bit slower than ecryptfs¹. And I am not aware of any other 
desktop or distribution integration work regarding CryFS, gocryptfs or 
another alternative.

[1] "The increase in security when compared to other file systems comes at 
a performance cost. CryFS is fast enough to be used in practice. I'm 
getting a read speed to 170MB/s and a write speed of 80MB/s on my SSD 
machine, but other file systems are even faster."

https://www.cryfs.org/comparison

Best,
-- 
Martin