# Data I/O operations for encrypted files

I need to implement a simple approach on a Linux system to encrypt/decrypt data and I would appreciate any feedback from you. Basically, I need to change a bit the behavior of the functions read/write.

I've checked some options such as EncFS, but they only perform encryption/decryption at file level (decrypt/encrypt the entire file at once). However, I need some solution at a fine-grained level, such as at block level. To make things easier, we only append data at the end of the file and we don't change existing data of the file.

Consider the following use case, as an example:

• File foo.txt is empty
• Write 10 bytes to file foo.txt
• Encrypt the input (10 bytes) and write it to the file foo.txt. Depending on the encryption algorithm, the plaintext and ciphertext sizes might differ.
• Read 6 bytes from file foo.txt
• How should you handle this situation? Should you decrypt everything you have and extract only 6 bytes?

What I have seen is that you most likely have to keep also metadata about the encrypted files as well (number of blocks, etc.). Thanks in advance!

What you’re describing is not much different from the encryption in storage systems… only that your “storage system” is a file (foo.txt) instead of a hard drive. Now, in a perfect world you would encrypt every block of data (that you store in foo.txt) with its own key, but that would be pretty impractical in your situation. From my point of view, the most obvious solution would be to use a “tweakable cipher” or a “tweakable narrow-block encryption mode”. They were designed to avoid (read: work around the problem) the “need separate key per stored data block”.