I do not hold a deep understanding of computer science concepts but would like to learn more about how the utility encfs works. I have a few question regarding the concept of filesystem in regards to encfs. It is said that encfs is a cryptographic filesystem wiki link.

1)To encrypt the files encfs is moving around blocks of the files to be encrypted, so am I correct to see this 'scrambled' version of the files as a new perspective which justifies the term of a new filesystem?

2)In the man pages of encfs in the section CEVEATS link to man of encfs online, it says that encfs is not a true file system. How should I understand this? Is that because some necessary features common to all file systems is missing in encfs' file system? Or is because of some other more substantial reason?

3)The man pages say that it creates a virtual encrypted file system. There are two questions here; what is it that makes it virtual is it that it is a file system within a file system? and the encrypted is that there is not a straight forward way to map the file blocks into a format to be read by other programs?

4)How does the command fusermount relate to encfs?


I think that behind your description, there is a misconception. The unencrypted data is not stored on the disk at any point. When you write to a file in the encfs filesystem, the write instruction goes to the encfs process; the encfs process encrypts the data (in memory) and writes the ciphertext to a file. The file names, as well as the file contents, are encrypted. Reading a file undergoes the opposite process: encfs reads the encrypted data from the disk file, decrypts it in memory and passes the plaintext to the requesting application.

When you run the encfs command, it does not decrypt any data. It only uses the password that you supply to unlock the filesystem's secret key. (This is actually a decryption operation, cryptographically speaking, but a different type from what happens with the file data. I will not go into more details here.)

1) Encfs is not exactly “moving blocks around”; it is decoding blocks when it reads them. Encfs is a filesystem because it behaves like one: you can store files on it, when it's mounted.

2) Encfs is not a “true” filesystem because it doesn't work independently. Encfs only provides an encryption layer; it uses an underlying filesystem to actually store data and metadata (metadata is auxiliary information about files such as permissions and modification times).

3) Virtual filesystem is another way to say that encfs itself doesn't store any data, it needs an underlying filesystem (see (2) above) for that. Encrypted means just that: encfs stores the data that you put in it in an encrypted form, which cannot be decrypted without the key. Another program could read the data stored by encfs if and only if that other program had access to the key (which requires the password that the key is protected with).

4) The fusermount command sets up a FUSE mount point. You would not normally call it directly, because a FUSE filesystem is implemented by a user-mode process which you have to start anyway, and that process (e.g. encfs) will take care of setting up the mount point. Unmounting a FUSE filesystem, on the other hand, is a generic operation, you can always do it by calling fusermount -u.

| improve this answer | |
  • very nice answer, and really clear. Would my layman interpretation be correct to say; "the un-encrypted file is only stored in memory, not on disk, and this in memory file view is presented by encfs while using the key, and the encrypted file on disk was created from the original file using the key given"? – Vass Jan 12 '12 at 12:22
  • @Vass Yes, this is correct. – Gilles 'SO- stop being evil' Jan 12 '12 at 12:45

1) No. It translates blocks of the file through an encryption algorithm. Moving blocks around would imply that you could see a bits of the file, just out of order. This is not the case. There isnt any bits of the original file that would be viewable looking at the encrypted version.

2) Its not a true filesystem because it doesnt handle actual storage of the data, it just translates it. So it doesnt have to worry about things like filesystem corruption, journaling, access permissions, etc. All that is handled by the underlying filesystem.

3) A) This is just the same as #2. It simply means that its not a real filesystem, it just looks like one. B) No, there is no straight forward way to map the file blocks, see #1. The encrypted data can be read by other programs yes, but the other program would need to know the encryption key. Nothing can be read without that key.

4) FUSE is a method of implementing filesystems in linux. Normally the code for handling the filesystem runs within the linux kernel. In the case of FUSE filesystems, an actual program does the job of running the filesystem. A program you can see with ps, and even kill it. fusermount is just a command used for mounting fuse filesystems. You can mount FUSE filesystems with the normal mount command, but fusermount lets non-root users mount the filesystem.

| improve this answer | |
  • I am still struggling with trying to create a pictorial representation of the mechanics in question 1. Would you please provide any step-by-step walk through the process? I have a confusion possibly because I picture a file unencrypted and when encfs encrypts it through the algorithm, the bits are rearranged in a way which makes it unreadable. How is it actually done? – Vass Jan 11 '12 at 23:53
  • 2
    This is by no means how it works, but it should give you an idea; Lets say you have an encryption key that is the number 5, and you have some data which is the number 123456. Do something like 123456 * 5. You get 617280. Now swap the pairs of digits so you end up with 162708. Now multiply by 5 again, and you have 813540. You cannot take this and get back to your original 123456 number without knowing you used the number 5 for those multiplications. This is the basic concept of encryption – Patrick Jan 12 '12 at 0:09
  • so 1)the encfs filesystem is something that uses the number 5 in a way to get back 123456? 2)If so, why is this called a file system and not something like a proxy, or file interface? A filesystem to me sounds much more grand and general purpose than an algorithm to get back the original order of the data. (thank you for you time:) – Vass Jan 12 '12 at 12:03
  • 1) yes, it performs the task of encrypting and decrypting your files with the given password (that 5 in the example). 2) because it behaves like a filesystem. however this is why you had your first question #2, its generally called a virtual filesystem. – Patrick Jan 12 '12 at 13:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.