Filesystem-level encryption, often called file or folder encryption, is a form of disk encryption where individual files or directories are encrypted by the file system itself. This is in contrast to full disk encryption where the entire partition or disk, in which the file system resides, is encrypted.
The advantages of filesystem-level encryption include:
- flexible file-based key management, so that each file can and usually is encrypted with a separate encryption key
- individual management of encrypted files e.g. incremental backups of the individual changed files even in encrypted form, rather than backup of the entire encrypted volume
- access control can be enforced through the use of public-key cryptography, and
- the fact that cryptographic keys are only held in memory while the file that is decrypted by them is held open.
General-purpose file systems with encryption
Unlike cryptographic file systems or full disk encryption, general-purpose file systems that include filesystem-level encryption do not typically encrypt file system metadata, such as the directory structure, file names, sizes or modification timestamps. This can be problematic if the metadata itself needs to be kept confidential. This also means that the content to be encrypted can always be discretely identified (its filename and metadata identifies the individual file to anyone including unauthorized users). This makes it impossible to make the content undetectable or its existence unprovable in ways that are possible using approaches such as virtual filesystems like a PGP disk.
Cryptographic file systems
Cryptographic file systems are specialized (not general-purpose) file systems that are specifically designed with encryption and security in mind. They usually encrypt all the data they contain – including metadata. Instead of implementing an on-disk format and their own block allocation, these file systems are often layered on top of existing file systems e.g. residing in a directory on a host file system. Many such file systems also offer advanced features, such as deniable encryption, cryptographically secure read-only file system permissions and different views of the directory structure depending on the key or user.
Given the coarsely stated differentiation between "filesystem-level encryption" and "cryptographic file systems," it should be clear to all but the novice that the former does not in any way implement automatic encryption, which—one imagines—is what the user would expect. Nor is a file kept encrypted automatically and updated, fully encrypted, in place: indeed, one must bodily decrypt, modify, and encrypt in order to make the least change. Anyone can use a third-party utility to encrypt this file or that folder on demand, so packaging that capability within the file browser and terming it "filesystem-level encryption" is, at best, deceptive. The differentiation indicated heretofore, that is, whether metadata is or is not encrypted, merely obfuscates the issue. Windows, in fact, does not provide any capability resembling automatic encryption: to this extent, at least, the oft-ballyhooed "filesystem-level encryption" is merely a minor convenience that frees the user from having to install a third-party encryption application.
See also
 | This cryptography-related article is a stub. You can help Wikipedia by expanding it. |