Content deleted Content added
ParanoidMike (talk | contribs) Updated understanding of individual file management - difference between FDE and F-LE is the encrypted files can individually be addressed |
No edit summary |
||
Line 12:
==Cryptographic file systems==
Cryptographic file systems are specialized (not general-purpose) file systems that are specifically designed with encryption and security in mind. They usually encrypt all the data they contain – including metadata. Instead of implementing an on-disk format and their own [[block allocation]], these file systems are often layered on top of existing file systems e.g. residing in a directory on a host file system. Many such file systems also offer advanced features, such as [[deniable encryption]], cryptographically secure read-only [[file system permissions]] and different views of the directory structure depending on the key or user.
Given the coarsely stated differentiation between "filesystem-level encryption" and "cryptographic file systems," it should be clear to all but the novice that the former does not in any way implement automatic encryption, which—one imagines—is what the user would expect. Nor is a file kept encrypted automatically and updated, fully encrypted, in place: indeed, one must bodily decrypt, modify, and encrypt in order to make the least change. Anyone can use a third-party utility to encrypt this file or that folder on demand, so packaging that capability within the file browser and terming it "filesystem-level encryption" is, at best, deceptive. The differentiation indicated heretofore, that is, whether metadata is or is not encrypted, merely obfuscates the issue. Windows, in fact, does not provide any capability resembling automatic encryption: to this extent, at least, the oft-ballyhooed "filesystem-level encryption" is merely a minor convenience that frees the user from having to install a third-party encryption application.
==See also==
| |||