I need to implement a simple approach on a Linux system to encrypt/decrypt data and I would appreciate any feedback from you. Basically, I need to change a bit the behavior of the functions read/write.
I've checked some options such as EncFS, but they only perform encryption/decryption at file level (decrypt/encrypt the entire file at once). However, I need some solution at a fine-grained level, such as at block level. To make things easier, we only append data at the end of the file and we don't change existing data of the file.
Consider the following use case, as an example:
- File foo.txt is empty
- Write 10 bytes to file foo.txt
- Encrypt the input (10 bytes) and write it to the file foo.txt. Depending on the encryption algorithm, the plaintext and ciphertext sizes might differ.
- Read 6 bytes from file foo.txt
- How should you handle this situation? Should you decrypt everything you have and extract only 6 bytes?
What I have seen is that you most likely have to keep also metadata about the encrypted files as well (number of blocks, etc.). Thanks in advance!