Can ecryptfs login and mount passphrases be changed?

Question

Consulting the Internet documentation and the UNIX manpages of ecryptfs, I found a bit confusing the random use of login and mount passphrases, wrapping and wrapped passphrases.

For instance, from man ecryptfs-unwrap-passphrase:

   ecryptfs-unwrap-passphrase is a utility to  unwrap  an  eCryptfs  mount
   passphrase  from  file,  using  a  specified  wrapping  passphrase, and
   display the decrypted result on standard out.

Running the command from terminal, the user is prompted with 'passphrase', that I discovered is supposed to be the login passphrase, in order to recover the mount passphrase. So I guess that login and wrapping passphrases should refer to the same passphrase as well as mount and wrapped passphrases.

My question is: how, if possible, can I change login and mount passphrases?

ecryptfs-setup-private ran with no options (as I did) is supposed to create a new Private encrypted folder with following passphrases:

• the login passphrase must match the Ubuntu user login password, so that by default when the user log in Ubuntu automatically the private folder is mounted
• the mount passphrase is randomly created, unless the user type a custom passphrase

I decided to Log in Ubuntu with the folder remaining encrypted so I deleted file ~/.ecryptfs/auto-mount. Now I would like to know if ecryptfs login passphrase can be changed and set different from my Ubuntu user login password.

Is ecryptfs-rewrap-passphrase what I need?

I also would like to know if I can change ecryptfs mount passphrase, because I chose a custom passphrase when it should be safer a random 16 bytes passphrase. I could not find any help on this.

Is running again ecryptfs-setup-private with options -f and -w a solution?

Answer 1

I don't think there's a way to change the mount passphrase, without erasing and starting over. The ecryptfs-setup-private

   -f, --force
          Force overwriting of an existing setup

Might work, but it should leave any currently encrypted files in the ~/.Private folder left with the old mount passphrase.

I'd suggest decrypting/mounting the ~/Private fodler, backing up all the files, for example with tar & gpg to keep them encrypted

tar -z -cv datadir | gpg -v -z 0 --output data.tar.gz.gpg -c

And then start over with ecryptfs-setup-private using your chosen (or random) mount & wrapping passphrases.

---

The wrapping passphrase should be the same as your user login passphrase, so you can login and decrypt your files at the same time. Changing the login passphrase normally (while you're logged in is good) will normally change the wrapping passphrase also (through PAM I believe).

However, if root changes your login passphrase, it should not change the wrapping passphrase - this is by design to prevent any root user or anyone else from reading your encrypted files without the proper passphrase. In that case, the new login passphrase won't match the wrapping passphrase, and you would have to run ecryptfs-rewrap-passphrase as you mentioned, which requires your old login passphrase. Or run ecryptfs-wrap-passphrase if you know the mount passphrase.

Therefore, if you forget your login passphrase, and have no backup copy of the mount passphrase, your encrypted files are effectively locked forever.