ENCFS(1) Encrypted Filesystem ENCFS(1) (NAME) encfs - (SYNOPSIS) encfs [--version] [-v|--verbose] [-c|--config] [-t|--syslogtag] [-s] [-f] [--annotate] [--standard] [--paranoia] [--insecure] [--reverse] [--reversewrite] [--extpass=program] [-S|--stdinpass] [--anykey] [--forcedecode] [-require-macs] [-i MINUTES|--idle=MINUTES] [-m|--ondemand] [--delaymount] [-u|--unmount] [--public] [--nocache] [--noattrcache] [--nodatacache] [--no-default-flags] [-o FUSE_OPTION] [-d|--fuse-debug] [-H|--fuse-help] rootdir mountPoint [-- [Fuse Mount Options]] (DESCRIPTION) EncFS rootdir () mountPoint . () . EncFS rootdir . . EncFS . (OPTIONS) --version EncFS . --verbose --version . -c, --config EncFS . -v, --verbose EncFS . . (-f) . -t, --syslogtag syslog syslog . syslog encfs . -s -s (single threaded) EncFS . EncFS . EncFS . -f -f (foreground) EncFS . EncFS (daemon) . -f . () syslog . --annotate stderr . --standard . . . --paranoia --standard paranoia ( ). --insecure . ! --reverse EncFS : . --reverse . . /tmp/crypt-view : encfs --reverse /home/me /tmp/crypt-view /tmp/crypt-view . /home/me/.encfs6.xml . : ENCFS6_CONFIG=/home/me/.encfs6.xml encfs /tmp/crypt-view /tmp/plain-view /tmp/plain-view /home/me . --reverse . : Filename Initialization Vector Chaining External IV Chaining. --reversewrite --reverse ( UniqueIV ). : Per-File Initialization Vectors. --extpass=program . "RootDir" . . EncFS (\n) . --extpass=/usr/lib/ssh/ssh-askpass EncFS ssh . : EncFS 2k . 1.4.x . -S, --stdinpass . encfs . . encfs . --anykey . EncFS . . EncFS . ( encfsctl) . : ..IP --forcedecode 4 MAC . MAC IO . --forcedecode . . --require-macs . encfs . MAC . -i, --idle=MINUTES (unmount) . . EncFS . . -m, --ondemand . --idle --extpass . EncFS . extpass . . --delaymount encfs . --ondemand . -u, --unmount (mountPoint) . --public encfs . FUSE . ( root) . --public : FUSE "allow_other" "default_permission" FUSE . --public encfs - . : encfs root -- . --public allow_other fuse . --nocache . EncFS "attr_timeout=0" "entry_timeout=0" FUSE . EncFS EncFS . EncFS . --nocache (reverse mode) . --noattrcache --nocache (attributes). --nodatacache --nocache (data). --no-default-flags Encfs 1.2.2 FUSE "use_ino" "default_permissions" . --no-default-flags . : encfs raw crypt encfs --no-default-flags raw crypt -- -o use_ino,default_permissions -o FUSE_ARG FUSE . FUSE EncFS mount ( /etc/fstab) . : mount encfs#/home/me-crypt /home/me -t fuse -o kernel_cache encfs . encfs (wrapper) encfs-reverse #!/bin/sh encfs --reverse "$@" : mount encfs-reverse#/home/me /home/me-crypt -t fuse -d, --fuse-debug FUSE . FUSE ( EncFS) . (verbose -v) EncFS . -H, --fuse-help FUSE . -- -- EncFS FUSE . FUSE fusermount . fusermount . (ENVIRONMENT VARIABLES) ENCFS6_CONFIG ( .encfs6.xml) . . . : . (master key) . ..SH " (EXAMPLES)" . () <<~/.crypt>> <<~/crypt>> . . encfs : % encfs ~/.crypt ~/crypt Directory "/home/me/.crypt" does not exist, create (y,n)?y Directory "/home/me/crypt" does not exist, create (y,n)?y Creating new encrypted volume. Please choose from one of the following options: enter "x" for expert configuration mode, enter "p" for pre-configured paranoia mode, anything else, or an empty line will select standard mode. ?> Standard configuration selected. Using cipher Blowfish, key size 160, block size 512 New Password: Verify: (mount) ~/crypt . ~/.crypt . (unmount) fusermount -u () : % fusermount -u ~/crypt . fusermount '/dev/foo' ( df /etc/mtab ) (caching) ( fusermount ): % encfs ~/.crypt ~/crypt -- -n /dev/foo -c (verbose mode) : % encfs -v -f ~/.crypt ~/crypt 2> encfs-report.txt ( ) . decode encfsctl . (CAVEATS) EncFS . . ( ) . EncFS ( ). . N EncFS 3*(N-2)/4 . EncFS . (plaintext) . (FILESYSTEM OPTIONS) EncFS EncFS . . (in-place) . . encfs encfs FUSE . ( 'standard' 'paranoia') (expert) . Standard : : AES : PBKDF2 : : IV (IV) (File holes passed through) Paranoia : : AES : PBKDF2 : : IV (IV) (MAC) (External IV Chaining) (File holes passed through) / . : (Key Derivation Function) 1.5 EncFS PBKDF2 . . . 1.6GHz AMD 64 . . EncFS 1.4.x 1.5 ( encfsctl ) PBKDF2 . Cipher . EncFS . OpenSSL Blowfish AES . Blowfish - . AES . Cipher Key Size . . ( ) . Filesystem Block Size ( ) EncFS . (IV) (cipher- block-chaining) . (stream mode) . EncFS . . . 1.0 . 0.x . Filename Encoding 1.1. (stream) (block) . . ( Blowfish AES). . . . . : stream () block () block32 (). () . 1.1 . Filename Initialization Vector Chaining 1.1. EncFS "foo" "XXX" "a/b/foo" "aa/foo/cc" . . (IV chaining) "a/foo" "b/foo" "foo" . ( ) . : . . EncFS . EncFS . Per-File Initialization Vectors 1.1. EncFS . (deterministic) N N . ( ) . . . (Reverse mode) IV inode ..IP "External IV Chaining" 4 ... << >> (Per-File Initialization Vectors) << >> (Filename Initialization Vector Chaining) . . . . encfs encfs . Block MAC . . External IV Chaining (hard links) . . ( ). . . . Block MAC headers .. ( Message Authentication Code) . EncFS . EncFS I/O . ( ) . EncFS . File-hole pass-through encfs (holes) . ( ). encfs SMB . . (expert mode) . (ATTACKS) EncFS . . EncFS . ( EncFS FUSE ) . . . EncFS : : ( ). EncFS XOR . . Block MAC . : . [] . : N N . Per-File Initialization Vector ( 1.1.x) . : . External IV Chaining . : . (Filename Initialization Vector chaining) - . : . Per-File Initialization Vector . (DISCLAIMER) . <> EncFS . (AUTHORS) EncFS Valient Gough . : https://vgough.github.io/encfs. ...: https://github.com/vgough/encfs. : . Cygwin Windows: https://github.com/vgough/encfs/wiki. (SEE ALSO) encfsctl(1) 1.9.5 2025-03-21 ENCFS(1)