BtrFS should support this really, but it doesn't. So ECryptFS looks like it will fill the gap. The only thing is, how would I layer compression on top of this?
Reasons for compression on top of encryption:
- intentionally, the converse (encryption on top of compression) doesn't compress, because encryption ideally tries to make the ciphertext indistinguishable from random data;
- encryption of denser information is more secure.
I'm looking for a filesystem-level solution such that files can be encrypted with different keys as appropriate (such as for users/groups) on an ad-hoc basis (i.e. can be changed without major reconfiguration that you have with block-level encryption).