encryption algorithm

Asked by stanio on 2010-06-14

What encryption algorithm is used by default and how can I change it?

Question information

Language:
English Edit question
Status:
Solved
For:
eCryptfs Edit question
Assignee:
No assignee Edit question
Solved by:
Ted_Smith
Solved:
2010-06-15
Last query:
2010-06-15
Last reply:
2010-06-14
Best Ted_Smith (tedsmith28) said : #1

Encryption alg : AES-128
Hashing alg : SHA512

To change it, you have to use eCryptfs manually (as far as I know) using the mount command:

1) Make a dir in your home dir, called whatever

sudo mount -t ecryptfs ~/whatever ~/whatever

This mounts the ~/whatever dir of the upper filesystem to the ~/whatever dir of the lower filesystem and will provide you with an encrypted dir until you logout. One of the options you are asked is what encryption alogirithm you wish to use. Choices are :

1) aes: blocksize = 16; min keysize = 16; max keysize = 32 (not loaded)
2) blowfish: blocksize = 16; min keysize = 16; max keysize = 56 (not loaded)
3) des3_ede: blocksize = 8; min keysize = 24; max keysize = 24 (not loaded)
4) twofish: blocksize = 16; min keysize = 16; max keysize = 32 (not loaded)
5) cast6: blocksize = 16; min keysize = 16; max keysize = 32 (not loaded)
6) cast5: blocksize = 8; min keysize = 5; max keysize = 16 (not loaded)

Choose one. Done.

To save you having to go through the options every time you log in and wish to retrieve the data, create a launcher from the desktop passing it the following values :

sudo mount -t ecryptfs ~/whatever ~/whatever -o key=YourLoginPassword, ecryptfs_cipher=aes, ecryptfs_key_bytes=16, ecryptfs_passthrough=n

Obviously, this presents a security risk.

Best advice is to stick with the default. Unless you work for the NSA, do you really need anything above AES-128? Schneier said in 2009 AES-128 is fine for the forseeable future.

stanio (s7an10) said : #2

ok, this is all I need.

Thank you.

stanio (s7an10) said : #3

Thanks Ted_Smith, that solved my question.