(wishlist) support for binary keyfile in mounting ecryptfs

How are you performing the eCryptfs mount?

mount.ecryptfs has the passphrase_passwd_file mount option which should meet your needs but I don't think that the more widely used mount.ecryptfs_private helper has anything like this.

let me describe more precisely:

Compare to a passphrase KEY FILE, a binary keyfile generated from urandom is more "random", so more secure
Compare to a openssl key FILE, openssl key needs userspace daemon to mount

Besides, a binary keyfile can be "shared" by different encryption system, reducing the number of key files kept by user

e.g use the same binary keyfile for encryptfs on a PC, LUKS on a notebook

That's not the part I needed clarification on. :)

How are you performing the eCryptfs mount? Are you using the "encrypted home" feature, are you using "mount -t ecryptfs dst src", are you mounting some other way?

I need to know which eCryptfs mount utility you'd like to pass a key file to.

i am using mount -t ecryptfs dst src

Ok, so does the passphrase_passwd_file=FILE mount option not meet your needs?

does passphrase_passwd_file=FILE option support binary keyfile?

On 2012-08-14 11:05:02, c wrote:
> does passphrase_passwd_file=FILE option support binary keyfile?

It should, but it rarely gets used or tested. Please let me know if it
doesn't work.

i test it at Xubuntu x64 12.04, ecryptfs-utils (96-0ubuntu3), kernel 3.2.0-29

it seems passphrase_passwd_file=FILE option do not support binary keyfile

Test case:

1. create testing directory "/test/test_all"
2. create binary key file

     dd if=/dev/urandom of=/test/test.keyfile count=1 bs=32

3. mount the ecrypt folder

     sudo mount -t ecryptfs -o key=passphrase:passphrase_passwd_file=/test/test.keyfile,ecryptfs_cipher=aes,ecryptfs_key_bytes=32,no_sig_cache,verbosity=0 /test/test_all /test/test_all

Result:

Error attempting to evaluate mount options: [-22] Invalid argument
Check your system logs for details on why this happened.
Try updating your ecryptfs-utils package, and/or
submit a bug report on https://launchpad.net/ecryptfs

Repeat the plan text keyfile "passwd=testing", the directory mount ok