Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

This question already has an answer here:

I'd like to set a single directory inside Dropbox in which files are encrypted on a file-by-file basis.

At the moment, I use a 2Mb Truecrypt container inside my Dropbox which I then have to mount manually, access/change the files within, then unmount manually. At that point, the entire 2Mb uploads to Dropbox. This is a pain for a number of reasons :

  1. Dropbox sync will only occur when the Truecrypt container is unmounted, because Dropbox only syncs files that aren't locked and mounting a container locks it.
  2. A single byte change to one file inside that container results in the whole 2Mb being uploaded again.
  3. It doesn't scale - I was originally using a 10Mb container, but obviously the bigger the container, the longer it takes to sync when it's unmounted.

I was wondering if I can somehow use LUKS to implement file-by-file encryption to get round the "container" issues.

share|improve this question

marked as duplicate by Alvar, Raja, Alvin Row, Eric Carvalho, Basharat Sialvi Aug 17 '13 at 17:51

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Your points #2 and #3 are not correct, Dropbox has a binary diff mechanism -- see dropbox.com/help/8. –  houbysoft Jan 1 '11 at 18:38
Then it doesn't work very well, at least with Truecrypt containers. Perhaps a symptom of how Truecrypt saves the files within the container. I've been using this for about 6 weeks now and it's painful. Worse because I'm on cable with a slow upload - I unmount even a 2Mb volume, I'm looking at roughly 3 minutes before Dropbox reports a successful sync. –  Scaine Jan 1 '11 at 19:16
Eh, yeah - I'm pretty sure that every byte in a Truecrypt container is re-encoded after close to ensure encryption integrity. Maybe I'm wrong, but it would explain why the binary diff makes so little difference. –  Scaine Jan 1 '11 at 19:18
The time it takes is strange, since I have a 250GB Truecrypt drive, and if every byte was rewritten as you suggested, it would take forever to use it, which is not the case currently (I can't notice any speed drop for normal usage). Therefore, I assumed that Truecrypt doesn't rewrite the whole file. –  houbysoft Jan 1 '11 at 20:45
These questions (& answers) should be merged IMO –  Uli Aug 14 '13 at 9:41

4 Answers 4

up vote 10 down vote accepted

I have two methods in place with my Dropbox.

The first is using #CryptKeeper Install CryptKeeper. This creates and mounts enc_fs encrypted directories, independent of the Ubuntu implementation of Private.

Instructions by Scaine on using Cryptkeeper are here: How can I do individual file encryption on Dropbox?

CryptKeeper screenshot

The second is symlinking selected directories from ~/.Private into the Dropbox directory. This automatically uploads (and syncs) the encrypted versions of files normally situated in ~/Private. This assumes you have set up the encrypted Private directory! It can also be initially tricky to find the correct one to link.

Ecryptfs screenshot

While neither of these is strictly encryption of a single file, as both use a container of sorts, both methods scale easily as only changed files are uploaded.

share|improve this answer
The first solution doesn't really let me share that data across two PCs easily though does it? I'll take a look at CryptKeeper. Thanks! –  Scaine Jan 1 '11 at 14:41
It does if they're both running Ubuntu! I probably have a slightly odd setup, though, in that I copied my whole /home from one laptop to the other so I had an exact duplicate, with Dropbox syncing my (encrypted) documents and things like .ssh back and forth. –  Jonathon Jan 1 '11 at 14:56
CryptKeeper is perfect. I'm going to post additional instructions on how to use it - please copy my answer to yours, then I'll accept your answer. Thanks Jonathon. –  Scaine Jan 1 '11 at 15:00
I've now got votes on my answer, so I'll just accept yours and keep mine as a reference. –  Scaine Jan 4 '11 at 9:07
I posted a guide which explains how to do cross-platform compatible encryption with encfs for Dropbox here: askubuntu.com/questions/75377/encrypting-data-in-ubuntu-one/… –  Uli Dec 2 '11 at 10:18

As far as I know there will be an integrated encryption mechanism in Dropbox in the future. (I so in feature's requests). At meantime you may encrypt/decrypt files locally then synchronise them via Dropbox storage.

Best wishes, And Calm and Prosperous Year 2011,


share|improve this answer
I know that Box.net has had this feature (for Enterprise users) for a while, so likely that Dropbox will add it, but the last update of Dropbox was only a couple of days ago and so sign, so I'm not holding my breath. I'm hoping that someone who knows a bit about LUKS will help - not keen on having to implement per-file encryption manually! –  Scaine Jan 1 '11 at 14:26

Cryptkeeper allows for a per-file encryption folder to be set up as follows :

Install Cryptkeeper :

sudo apt-get install cryptkeeper

Create an encrypted container :

alt text

Left click on the Cryptkeeper icon, then right-click on your new container and delete it (Choose "Delete Encrypted Folder").

Choose "Ok" at the first prompt :

alt text

Then choose "No" at the last prompt :

alt text

Now you'll have a .Private_encfs folder in the directory you specified earlier. Copy this up to Dropbox at the location of your choosing, then simply import that folder from the Cryptkeeper icon. When you import, you'll be asked where you'd like your encrypted data to be mounted. Choose somewhere outside of Dropbox and you'll have a fully encrypted folder integrated into Nautilus into which you can place sensitive files and the encrypted versions of those files will be uploaded to Dropbox automatically.

share|improve this answer

I use TrueCrypt inside (gigabyte volumes) DropBox and you do not have to upload the whole container every time you change a file. On TrueCrypt GUI there is something called Preserve Time stamp just un tick it (google it) and you will only upload the parts of the container that has changed. Works really well – one thing to keep in mind if you sync with Mac is that if you click on your volume to mount it and you are tempted to select TrueCrypt to be associated with that file Mac will add a resorue fork which Linux Dropbox will refuse to sync. To fix it download FileBuddy on the Mack and use the delete option where you will be offered the option of deleting just the resource fork. Truecrypt has advantages the Cryptkeeper/ecryptfs-util does not have. I think with the Cryptkeeper you may take advantage of the versioning capability of DropBox but I have not tested this.

Best of luck

share|improve this answer
Nice one - useful reference, although I'm now very happy with the Cryptkeeper solution. Can you give examples of where you see Truecrypt have "advantages Cryptkeeper/ecryptfs-util does not have"? –  Scaine Sep 23 '11 at 12:33

Not the answer you're looking for? Browse other questions tagged or ask your own question.