Hacker News Reader

Comment by tptacek | Hacker News Reader

Safe is a wrapper around EncFS, which (a) potentially leaks a lot of metadata and (b) is a weird combination of CBC and CFB. I'd feel better about Truecrypt.

View on HN

I would probably think twice before using anything based on EncFS. See this audit for a lot of detail: https://defuse.ca/audits/encfs.htm

we're actually in the process of updating encfs to use XTS. also, that particular audit was done quickly and some of the analyses weren't done considering the threat-model that encfs is designed for (so it makes encfs look worse than it really is).

I removed this sentence from my previous comment to parent: From a layman's perspective, I should think the encfs authors came away from that analysis with a feeling of achievement: to have been audited (however quickly) and yet to live.

If the above (grand-parent) is the worst tptacek says about encfs, I would argue that you are in decent shape.

encfs encrypts a-file-at-a-time, right? That's not an XTS use case.

It can be. We want to move away from IV-based encryption primitives to tweak-based primitives for each individual file. This is just so more people understand how it works, especially since now XTS is a recommended standard. Right now we use a custom solution, which made sense in 2004 but now that XTS exists we can switch over.

Wait, XTS is a standard recommended for block-level disk encryption. It's not a recommendation for file encryption. The two problems are similar, but not identical; for instance, block encryption has strict requirements on ciphertext size, and requires the capability to modify ciphertexts instead of just re-encrypting. Are you sure XTS is a good idea for file encryption? Wouldn't a simple AEAD mode do the job just as well, and also provide for file integrity?

As this surfaced, I was chiefly impressed by the fact that encfs was amenable to such a by-and-by[0] audit: the code-base must be at least somewhat legible.

This "auditability" seems to me a strength worth nurturing.

[0] Where "by-and-by" refers to the usual superhuman app-sec standards in which "10 hours" translate into actual, meaningful work.

Defuse has done quick audits on both EncFS and eCryptfs. Both store their encrypted files in another file system. eCryptfs did substantially better then EncFS

https://defuse.ca/audits/encfs.htm https://defuse.ca/audits/ecryptfs.htm

Truecrypt is a different beast (acts as the basis blob or blockdev for a file system) and has done significantly better on more rigorous audits: https://opencryptoaudit.org/reports/

As glossarian in residence I cannot but expand the above app-sec acronyms:

* CBC - Cipher block chaining: https://en.wikipedia.org/wiki/Cipher_block_chaining#Cipher-b...

* CFB - Cipher feedback: https://en.wikipedia.org/wiki/Block_cipher_modes_of_operatio...

As evinced by the structural similarity of the diagrams in the pages above, the two are very similar; hence tptacek's characterisation of their combination in encfs as "weird", I presume.

* XTS - "XEX-based tweaked-codebook mode with ciphertext stealing": https://en.wikipedia.org/wiki/XEX-TCB-CTS#XEX-based_tweaked-...

I have to more or less hope this is the encryption mode referenced above. NIST recommends an AES cipher to employ with it.

Resolving all acronyms here seems futile (albeit entertaining), thus I will simply rest.

(This is my last unsolicited reply in this thread, I promise.)

Of course, encfs aims to hit a very specific sweet spot with their emphasis on backup-friendly per-file encryption as opposed to Truecrypt's container approach.

Which is begging the question, naturally.

edit: To wit, whether an alternative exists that would satisfy the encfs use case.

What are your thoughts on the "encrypted homedirs" in Ubuntu?

Everyone hearts Truecrypt yet given the media fury caused by the Snowden leaks and the hunt for the real Satoshi Nakamoto, why is there zero attention about the fact that Truecrypt is also anonymously developed?

Huh? There is almost nothing but attention to Truecrypt's anonymous authorship. That's the entire reason Matthew Green organized the iSEC audit.

Sorry, I was commenting on the fact that given what we now know about the NSA's TAO etc, you still feel comfortable with encryption software written by anonymous developers.

You just asked the same question twice. See previous answer.

Truecrypt versus dm-crypt+LUKS?

Reply on news.ycombinator.com