When encrypting a user's home directory, either during the install procedure or later using ecryptfs-migrate-home, what encryption algorithm / key size is used by default?

up vote 6 down vote accepted

The above answer is right, that AES is the cipher, but the reasoning is wrong.

User's home directories are configured by the script ecryptfs-setup-private.

In that shell script, the cipher and key length are harcoded:

CIPHER="aes" 
KEYBYTES="16"

Likewise, in the C source code of the setuid mount helper, mount.ecryptfs_private, it is also hardcoded:

#define KEY_BYTES 16    
#define KEY_CIPHER "aes"

These values were hard coded to minimize the support burden of helping millions of users encrypt their home directories.

The default ecryptfs algorithm is aes.

It can be shown during the creation of a new encrypted mount point of folder that only aes is presently loaded but ecryptfs supports other logarithms.

bruno@ubuvbox:~$ sudo mount -t ecryptfs secret/ ~/secret/
Passphrase: 
Select cipher: 
 1) aes: blocksize = 16; min keysize = 16; max keysize = 32 (loaded)
 2) blowfish: blocksize = 16; min keysize = 16; max keysize = 56 (not loaded)
 3) des3_ede: blocksize = 8; min keysize = 24; max keysize = 24 (not loaded)
 4) cast6: blocksize = 16; min keysize = 16; max keysize = 32 (not loaded)
 5) cast5: blocksize = 8; min keysize = 5; max keysize = 16 (not loaded)
Selection [aes]: 

Default selected cipher is between [].

  • I thought the minimum key-size for AES was 128? Why so weak? – Razick Mar 29 '13 at 21:03
  • 3
    @Razick Based on the other answer to this question, I assume that the 16 refers to the key size in bytes, i.e. 16*8 = 128 bits. – Ian Renton May 29 '13 at 22:14

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.