Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I thought changing the password with 'encfsctl passwd path/to/encrypted' would change all filenames. But it didn't work. Any ideas why?

I got this, so the password was changed correctly:

Enter current Encfs password
EncFS Password:
Enter new Encfs password
New Encfs Password:
Verify Encfs Password:
Volume Key successfully updated.
share|improve this question
add comment

1 Answer

up vote 5 down vote accepted

Data encryption systems (typically) do not directly encrypt the data with the password. The problem with doing this is that when the password is changed, all the data needs to be re-encrypted, which is a very intensive process. (It also prevents supporting multiple passwords.) Instead, a random key is generated when the system is initialised, and the data is encrypted with this random key. The random key is then encrypted with the password and stored on disk. To decrypt the data the password is first used to decrypt the random key, and then the random key is used to decrypt the data. Changing the password simply involves re-encrypting this random key, and not all the data.

The encfs manpage mentions:

The user must supply a password which is used to (indirectly) encrypt both filenames and file contents.

which implies that it uses this scheme.

share|improve this answer
1  
If it re-encrypted everything with a brand new key, you'd have two keys you would have to keep secret forever to protect the data -- the old one (because it could decrypt backups of your encrypted data) and the new one (because it could decrypt the re-encrypted data) -- instead of just one. –  David Schwartz Jul 1 '12 at 9:34
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.