Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When encrypting a user's home directory, either during the install procedure or later using ecryptfs-migrate-home, what encryption algorithm / key size is used by default?

share|improve this question
up vote 5 down vote accepted

The above answer is right, that AES is the cipher, but the reasoning is wrong.

User's home directories are configured by the script ecryptfs-setup-private.

In that shell script, the cipher and key length are harcoded:


Likewise, in the C source code of the setuid mount helper, mount.ecryptfs_private, it is also hardcoded:

#define KEY_BYTES 16    
#define KEY_CIPHER "aes"

These values were hard coded to minimize the support burden of helping millions of users encrypt their home directories.

share|improve this answer

The default ecryptfs algorithm is aes.

It can be shown during the creation of a new encrypted mount point of folder that only aes is presently loaded but ecryptfs supports other logarithms.

bruno@ubuvbox:~$ sudo mount -t ecryptfs secret/ ~/secret/
Select cipher: 
 1) aes: blocksize = 16; min keysize = 16; max keysize = 32 (loaded)
 2) blowfish: blocksize = 16; min keysize = 16; max keysize = 56 (not loaded)
 3) des3_ede: blocksize = 8; min keysize = 24; max keysize = 24 (not loaded)
 4) cast6: blocksize = 16; min keysize = 16; max keysize = 32 (not loaded)
 5) cast5: blocksize = 8; min keysize = 5; max keysize = 16 (not loaded)
Selection [aes]: 

Default selected cipher is between [].

share|improve this answer
I thought the minimum key-size for AES was 128? Why so weak? – Razick Mar 29 '13 at 21:03
@Razick Based on the other answer to this question, I assume that the 16 refers to the key size in bytes, i.e. 16*8 = 128 bits. – Ian Renton May 29 '13 at 22:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.