Filesystem-level encryption, often called file or folder encryption, is a form of disk encryption where individual files or directories are encrypted by the file system itself. This is in contrast to full disk encryption where the entire partition or disk, in which the file system resides, is encrypted.
The advantages of filesystem-level encryption include:
- flexible file-based key management and access control, so that each file can and usually is encrypted with a separate encryption key
- individual file management e.g. incremental backups of just the changed files, rather than backup of the entire volume
- the use of public-key cryptography, and
- the fact that cryptographic keys are only held in memory while the file that is decrypted by them is held open.
General-purpose file systems with encryption
Unlike cryptographic file systems or full disk encryption, general-purpose file systems that include filesystem-level encryption do not typically encrypt file system metadata, such as the directory structure, file names, sizes or modification timestamps. This can be problematic if the metadata itself needs to be kept confidential. This also means that the content to be encrypted can always be discretely identified (its filename and metadata identifies the individual file to anyone including unauthorized users). This makes it impossible to make the content undetectable or its existence unprovable in ways that are possible using approaches such as virtual filesystems like a PGP disk.
Cryptographic file systems
Cryptographic file systems are specialized (not general-purpose) file systems that are specifically designed with encryption and security in mind. They usually encrypt all the data they contain – including metadata. Instead of implementing an on-disk format and their own block allocation, these file systems are often layered on top of existing file systems e.g. residing in a directory on a host file system. Many such file systems also offer advanced features, such as deniable encryption, cryptographically secure read-only file system permissions and different views of the directory structure depending on the key or user.
See also
 | This cryptography-related article is a stub. You can help Wikipedia by expanding it. |