Which algorithm does “encrypt home directory” use?

Question

When encrypting a user's home directory, either during the install procedure or later using ecryptfs-migrate-home, what encryption algorithm / key size is used by default?

Answer 1

The default ecryptfs algorithm is aes.

It can be shown during the creation of a new encrypted mount point of folder that only aes is presently loaded but ecryptfs supports other logarithms.

bruno@ubuvbox:~$ sudo mount -t ecryptfs secret/ ~/secret/
Passphrase: 
Select cipher: 
 1) aes: blocksize = 16; min keysize = 16; max keysize = 32 (loaded)
 2) blowfish: blocksize = 16; min keysize = 16; max keysize = 56 (not loaded)
 3) des3_ede: blocksize = 8; min keysize = 24; max keysize = 24 (not loaded)
 4) cast6: blocksize = 16; min keysize = 16; max keysize = 32 (not loaded)
 5) cast5: blocksize = 8; min keysize = 5; max keysize = 16 (not loaded)
Selection [aes]: 

Default selected cipher is between [].

Answer 2

The above answer is right, that AES is the cipher, but the reasoning is wrong.

User's home directories are configured by the script ecryptfs-setup-private.

In that shell script, the cipher and key length are harcoded:

CIPHER="aes" 
KEYBYTES="16"

Likewise, in the C source code of the setuid mount helper, mount.ecryptfs_private, it is also hardcoded:

#define KEY_BYTES 16    
#define KEY_CIPHER "aes"

These values were hard coded to minimize the support burden of helping millions of users encrypt their home directories.