I'm using "eCryptfs" on several directories on my dedicated Debian server. I mount them manually via

mount -t ecryptfs [dir] [mountpoint]

But after some weeks being mounted it's not easy to remember the exact passwords for each directory. I want to make sure that I got the right passwords before unmounting them or rebooting the server.

I thought of generating an "eCryptfs" signature and comparing it with the directory's "eCryptfs" signature. Which parameters do I need to know and what is the algorithm for the "eCryptfs" signature? And is this the right way to verify my password?

  • 4
    $\begingroup$ This appears to be a tech support question about using or fixing technology to work as advertised. Unix.SE and AskUbuntu could provide more in-deep and more on-point answers on how to use the related software. $\endgroup$
    – e-sushi
    Dec 6 '13 at 18:50

You can use the ecryptfs-add-passphrase command to add a passphrase to your kernel keyring, which will also print the signatures (hashes) to standard out.

Once you've added a passphrase to the keyring, you might want to clear it, using the keyctl command.

eCryptfs uses a PBKDF2-like, key strengthening algorithm of 65536 rounds of SHA512.

(Disclosure: I am one of the authors and maintainers of eCryptfs.)

  • $\begingroup$ When you specify that it is using said algorithm, it would appear that is an algorithm used to generate a key from the passphrase, said key being used for a symetric cipher. If that is the case, how is the signature generated? $\endgroup$
    – MetaChrome
    Dec 6 '13 at 18:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.