Filesystem-level encryption: Difference between revisions

Revision as of 11:31, 29 May 2007

Revision as of 15:05, 14 June 2007

Line 1:

'''Filesystem-level encryption''', often called file or folder encryption, is a form of [[disk encryption]] where individual files or directories are [[encryption|encrypted]] by the [[file system]] itself,. This is in contrast to [[full disk encryption]] where the entire partition or disk, wherein which the file system resides on, is encrypted.

The advantages of filesystem-level encryption include:

The advantages of filesystem-level encryption include more flexible file-based [[key management]] and [[access control]] with [[public-key cryptography]] and the fact that [[key (cryptography)|cryptographic keys]] are only kept in memory while a file using them is opened.

* flexible file-based [[key management]] and [[access control]], so that each file can and usually is encrypted with a separate encryption key

* individual file management e.g. incremental backups of just the changed files, rather than backup of the entire volume

* the use of [[public-key cryptography]], and

* the fact that [[key (cryptography)|cryptographic keys]] are only held in memory while the file that is decrypted by them is held open.

==General-purpose file systems with encryption==

Unlike cryptographic file systems andor full disk encryption, genericgeneral-purpose file systems withthat include filesystem-level encryption do not typically encrypt file system [[metadata]], such as the directory structure, file names, sizes or modification timestamps. This can be problematic if the metadata itself needs to be kept confidential. This also means that the content to be encrypted hascan toalways be discretely identified (its filename and metadata identifies the individual file to anyone including unauthorized users). This makes it impossible to make the content undetectable or its existence unprovable in ways that are possible using approaches such as virtual filesystems like a PGP disk.

==Cryptographic file systems==

Cryptographic file systems are specialized (not general-purpose) file systems that are specifically designed with encryption and security in mind. They usually encrypt all the data they contain – including metadata. Instead of implementing an on-disk format and their own [[block allocation]], these file systems are often layered on top of existing file systems, for example,e.g. residing in a directory on a host file system. Many such file systems also offer advanced features, such as [[deniable encryption]], cryptographically secure read-only [[file system permissions]] and different views of the directory structure depending on the key or user.

==See also==