ecryptfs - Encrypting identical files with the same key leads to different results

Question

My understanding so far has been that ecryptfs uses a wrapped passphrase to encrypt files. When I mount two pairs of encrypted/decrypted directories using the same key I expect the same result when encrypting the key. However, this seems not to be true:

$ sudo mount -i -t ecryptfs -o ecryptfs_passthrough=n,ecryptfs_enable_filename_crypto=n,ecryptfs_sig=f8ac65b530d4aebc,ecryptfs_key_bytes=32,ecryptfs_cipher=aes,ecryptfs_xattr=y safe1/ open1
$ sudo mount -i -t ecryptfs -o ecryptfs_passthrough=n,ecryptfs_enable_filename_crypto=n,ecryptfs_sig=f8ac65b530d4aebc,ecryptfs_key_bytes=32,ecryptfs_cipher=aes,ecryptfs_xattr=y safe2/ open2
$ echo "Hi" > open1/testfile
$ cp -a open1/testfile open2/testfile 
$ md5sum open*/testfile
31ebdfce8b77ac49d7f5506dd1495830  open1/testfile
31ebdfce8b77ac49d7f5506dd1495830  open2/testfile
$ md5sum safe*/testfile
4fe5016ca0b9b283fd05e03ccaee0b14  safe1/testfile
75850506e568f60a77acd96dfb2d2895  safe2/testfile

I think this is not related to the content of the file but to some metadata. Because when I copy encrypted file from one space to the other I can decrypt the content

$ umount open*
$ cp -a safe2/testfile safe1/testfile2
$ sudo mount -i -t ecryptfs -o ecryptfs_passthrough=n,ecryptfs_enable_filename_crypto=n,ecryptfs_sig=f8ac65b530d4aebc,ecryptfs_key_bytes=32,ecryptfs_cipher=aes,ecryptfs_xattr=y safe1/ open1
$ sudo mount -i -t ecryptfs -o ecryptfs_passthrough=n,ecryptfs_enable_filename_crypto=n,ecryptfs_sig=f8ac65b530d4aebc,ecryptfs_key_bytes=32,ecryptfs_cipher=aes,ecryptfs_xattr=y safe2/ open2
$ cat open1/testfile2 
Hi

Can anyone explain this behavior?

What I'm looking for is a way that the encrypted file in the example above are identical.

Answer 1

The difference in encrypted value is by design. Each encrypted file has a per-file randomly generated session key.