Today I set up an ecryptfs directory, which is automatically mounted at login via pam. To do so i followed the guide in the ecryptfs readme


To sum up, I now have a key stored in the usser session keyring. The first thing I do not understand is why this key is only showing up via keyctl show and not with the gnome-gui "Passwords and encryption keys".

The second thing I am curious about is the security. I assume that my passphrase is somehow stored on the harddisk. But how exactly and how secure is this?

Thanks in advance


The gnome-keyring session is separate from the "in kernel" session keys. The Gnome Keyring Manager is used to hold direct passwords and hand them out when applications need them (like when checking your email or logging into remote systems). The kernel keyring is used for in-kernel operations that need encryption, like eCryptfs.

Neither eCryptfs nor the Gnome Keyring Manager store your passphrases in the clear. Gnome Keyring Manager stores an encrypted database to disk and keeps passphrases in memory only. The eCryptfs tools do a similar thing: your mount passphrase (a large random bit string) is encrypted on disk with your login passphrase. This is what is used internally by eCryptfs and again, does not hit the disk in the clear.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.