Gocryptfs: Why use AES-256-EME to encrypt file names?
It's error prone to create your own crypto implementation ( https://github.com/rfjakob/eme ). Not easy to get it right. And it looks like AES-EME is not an authenticated encryption.
AES-GCM is being used to encrypt file contents. Why not use AES-GCM to encrypt file names as well?
anysync
All 2 comments
Good question! File name encryption is a little bit special because it needs to be deterministic. AES-GCM needs a random nonce, which means that the a file name like example.txt has a virtually infinite number of encrypted representations. This makes checking for duplicates and even opening an existing file inefficient. You'd basically have to read the whole directory and decrypt everything all the time.
rfjakob
on 29 Apr 2017
I'm gonna close this. Feel free to reopen if other questions!
rfjakob
on 3 May 2017
Related issues
emreuenal
路
12Comments
slackner
路
14Comments
brain-freeze
路
18Comments
ccchan234
路
8Comments
brainchild0
路
5Comments
Most helpful comment
Good question! File name encryption is a little bit special because it needs to be deterministic. AES-GCM needs a random nonce, which means that the a file name like
example.txthas a virtually infinite number of encrypted representations. This makes checking for duplicates and even opening an existing file inefficient. You'd basically have to read the whole directory and decrypt everything all the time.