Conclusion from an EncFS audit:

EncFS is probably safe as long as the adversary only gets one copy of the ciphertext and nothing more. EncFS is not safe if the adversary has the opportunity to see two or more snapshots of the ciphertext at different times.

I don't quite understand this sentence: "to see two or more snapshots of the ciphertext at different times". Given a scenario, e.g. my Dropbox was hacked, and the hacker has access to my EncFS encrypted texts, and probably the history of it as well. Is that what was mentioned as "two or more snapshots" and "different times"?

up vote 3 down vote accepted

Given a scenario, e.g. my Dropbox was hacked, and the hacker has access to my EncFS encrypted texts, and probably the history of it as well. Is that what was mentioned as "two or more snapshots" and "different times"?

Whether it applies depends on how the storage system would work. As far as I can tell, EncFS itself has no backup/versioning capability. Assuming that is the case, a storage system which supports history could implement it in one of two ways:

  1. Do the versioning on top of EncFS. So the versioning system itself is stored in the encrypted filesystem.
  2. Do it on a level below EncFS. So different versions of the filesystem exist.

In the former case, an attacker who only gained access to the system once could not see two copies of the ciphertext. In the latter they could.

In the real world, it is possible both would be used. E.g. if versioning is done on top of EncFS, but whole system backups are also stored. An attacker who got access to backups would be in a better position to break the encryption.

However, the audit details several weaknesses that even an attacker who only got access to a single snapshot could exploit, so I would disagree with the conclusion you quoted. For example, an attacker could punch holes in files without being noticed, and if the filesystem was large enough could find IV collisions leaking information on plaintext.


Is EncFS good for online storage services?

I would argue that it is not. It is probably better than nothing and if only passive attackers need to be protected against it may even be secure. However, even the README points to some more modern alternatives. (Without saying EncFS is insecure or anything.)

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.