0

I used to store a random generated keyfile in a SmartCard and TrueCrypt was able to access this keyfile using PKCS #11.

I'm trying EncFS now. Some people complain about it storing some of its encryption data (iterations number, salt, etc) in a plain text XML file. These data are valuable for an adversary to hack it, therefore people suggest saving the file in a secure place.

I had then the idea of storing it in a SmartCard/Token. The XML file has a few bytes over 1KB, so any SmartCard should be able to store it.

The issue is that, usually, these keyfiles are read directly by each app using PKCS #11 API. In Windows I'm using EncFSMP for handling EncFS mounting. It only has a checkbox for setting the config file is external, and a simple Open File Dialog for selecting the file in normal file system. There's no PKCS #11 interface as TrueCrypt has.

Anybody has any idea how this could be made work?

I google and found no solution, I suppose nobody would create a software for mounting a SmartCard as a Windows drive, so that it emulates a file system and any app could read a keyfile using good old fopen().

I believe it would be possible to develop an EncFS GUI as EncFSMP, that supports PKCS #11 and reads the keyfile and provides it as the config XML to EncFS, but of course we'd need somebody with EncFS and PKCS #11 skills to do the job.

If there is another software like eCryptFS that supports SmartCard keyfile I'd also like to know. Found nothing till now, it seems that only TrueCrypt has this feature.

1 Answer 1

1

I don't think there is anything really sensitive in the .encfs6 (currently named, used to be .encfs5) file, the salt & iterations primarily stop rainbow tables, and may help slightly with a dictionary attack, but if you're using a dictionary word as a passphrase that's what really should change.

Even PGP/GPG encrypted files have the salt & count easily visible, adding -vv will reveal them before the passphrase is asked for:

$ gpg -vv sample.gpg 
:symkey enc packet: version 4, cipher 9, s2k 3, hash 2
    salt x0x0x0x0x0x0x0x0, count 99999 (99)
gpg: AES256 encrypted data
...

If there were really a security concern with having such data easily visible, PGP/GPG would certainly be doing things differently.

Your efforts may be better spent finding a program to read & use the passphrase stored on a smart card/token, even automatically typing it into any clicked-on window may work, or a macro or similar?


Slightly related: The .encfs6 config file should definitely be backed up somewhere safe, if it were lost then you'd have to try guessing the salt & parameters to get back into your encrypted files, even knowing the passphrase it's not a simple quick task to recover access.

4
  • Interesting, thanks for the answer. Anyway, I've read complaints on EncFS for these data be easily accessible, and claiming eCryptFS as more secure because of that. They also suggest hiding this file on a USB drive, and some people seem to do it. Based on those complaints I had the idea of storing this file on a secure place.
    – Hikari
    Jan 20, 2016 at 14:03
  • Your description remembers me of KeePass, is that what you're suggesting? I already use it. I know it has a PKCS#11 plugin, but have never used it.
    – Hikari
    Jan 20, 2016 at 14:04
  • If KeePass can access smart card/tokens, then it would be an excellent idea. And I've often heard eCryptFS described as a pgp-based file encryption system, so I would be surprised if they didn't have their salt & count/rounds easily visible too. I think it's just the plaintext .encfs6 file that makes people think it's less secure, just because they can read it with a text editor themselves, forgetting pgp does the same thing. If it's good enough for pgp, it's good enough for me. Here's a Q about hiding salt (probably not the best one, but looks helpful)
    – Xen2050
    Jan 20, 2016 at 21:44
  • Well if PGP does the same, so be it. Thanks.
    – Hikari
    Mar 18, 2016 at 18:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .