Using EFS to encrypt a file on Windows 10. Does EFS use public/private key pairs? If it does, does that mean I can give the public part of the key to others, so they can encrypt files and send them to me, so only I can decrypt the files as I am the only one with the private key?


Yes, EFS uses hybrid encryption using per-user RSA keypairs (actually self-signed X.509 cer­tifi­cates), and you can import a certificate into Windows' Certificate Manager under "Other People" to use it for file encryption.

When EFS is used by multiple accounts on the same machine, their certificates will even au­to­mat­i­cal­ly show up under "Other People". (Run certmgr.msc to open the manager.)

Remember however that EFS is transparent, filesystem-level encryption – it only works as long as the file is stored on the local disk. Because programs automatically see decrypted data, trying to send the file over the network will also result in sending the decrypted original and not the EFS-encrypted version.

(It is possible to "backup" an EFS-encrypted file using administrator privileges, without decrypting it, and then "restore" it onto a different system – but there is no ready tool for doing so.)

  • In other words, EFS is not a solution that can be used, to recieved encrypted files. If you want that capability use a container (i.e. Veracrypt) or mount a virtual HDD that has been encrypted with BitLocker. However, in both those cases, you don't have a certificate that can be passed around but a passphrase. – Ramhound Oct 1 '19 at 16:14
  • @ramhound - you don't need a container/virtual drive - you can encrypt individual files using certificates in many ways. For example sid-500.com/2017/10/29/powershell-encrypt-and-decrypt-data – lx07 Oct 1 '19 at 19:42
  • @lx07 - Using PowerShell to encrypt a file isn't using EFS (Encrypted File System) to encrypt the file. I only gave two possible examples anyways. – Ramhound Oct 1 '19 at 20:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.