Filesystem-level encryption

From Wikipedia, the free encyclopedia

Filesystem-level encryption, often called file or folder encryption, is a form of disk encryption where individual files or directories are encrypted by the file system itself, in contrast to full disk encryption where the entire partition or disk, where the file system resides on, is encrypted.

The advantages of filesystem-level encryption include more flexible file-based key management and access control with public-key cryptography and the fact that cryptographic keys are only kept in memory while a file using them is opened.

[edit] General-purpose file systems with encryption

Unlike cryptographic file systems and full disk encryption, generic file systems with filesystem-level encryption do not typically encrypt file system metadata, such as the directory structure, file names, sizes or modification timestamps. This can be problematic if the content to be encrypted has to be undetectable or its existence unprovable.

Notable file systems that support this kind of encryption include the Encrypting File System layer of NTFS.

[edit] Cryptographic file systems

Cryptographic file systems are file systems that are specifically designed with encryption and security in mind. They usually encrypt all the data they contain – including metadata. Instead of implementing an on-disk format and their own block allocation, these file systems are often layered on top of existing file systems, for example, residing in a directory on a host file system. Many such file systems also offer advanced features, such as deniable encryption, cryptographically secure read-only file system permissions and different views of the directory structure depending on the key or user.