Encrypted overlay filesystem written in Go
See the code
An encrypted overlay filesystem written in Go. Official website: https://nuetzlich.net/gocryptfs (markdown source).
[!WARNING]
The website "gocryptfs.com" is not affiliated with the gocryptfs project!
gocryptfs is built on top the excellent go-fuse FUSE library. This project was inspired by EncFS and strives to fix its security issues while providing good performance (benchmarks). For details on the security of gocryptfs see the Security design document.
All tags from v0.4 onward are signed by the gocryptfs signing key. Please check Signed Releases for details.
gocryptfs has reached version 1.0 on July 17, 2016. It has gone through hours and hours of stress (fsstress, extractloop.bash) and correctness testing (xfstests). It is now considered ready for general consumption.
The old principle still applies: Important data should have a backup. Also, keep a copy of your master key (printed at init) in a safe place. This allows you to access the data even if the gocryptfs.conf config file is damaged or you lose the password.
The security of gocryptfs has been audited in March 3, 2017. The audit is available here (defuse.ca).
Linux is gocryptfs' native platform.
Beta-quality macOS support is available, which means most things work fine but you may hit an occasional problem. Check out ticket #15 for the history of macOS support but please create a new ticket if you hit a problem.
For Windows, an independent C++ reimplementation can be found here: cppcryptfs
Standalone tools:
gocryptfs-inspect is Python tool that can decrypt files & file names without using FUSE.
gocryptfs-create-folder is a Python tool can encrypt a directory without using FUSE.
Precompiled binaries that work on all x86_64 Linux systems are available
for download from the github releases page. The fuse package from your
distribution must be installed for mounting to work.
gocryptfs is also available as a package in most distributions. Examples:
apt install gocryptfspacman -S gocryptfsport install gocryptfsSee the Quickstart page for more info.
gocryptfs comes with is own test suite that is constantly expanded as features are
added. Run it using ./test.bash. It takes about 1 minute and requires FUSE
as it mounts several test filesystems.
The stress_tests directory contains stress tests that run indefinitely.
In addition, I have ported xfstests to FUSE, the result is the
fuse-xfstests project. gocryptfs
passes the "generic" tests with one exception, results: XFSTESTS.md
A lot of work has gone into this. The testing has found bugs in gocryptfs as well as in the go-fuse library.
Install Go 1.13 or higher:
apt install golangdnf install golangThen, download the source code and compile:
$ git clone https://github.com/rfjakob/gocryptfs.git
$ cd gocryptfs
$ ./build-without-openssl.bash
This will compile a static binary that uses the Go stdlib crypto backend.
If you want to use the OpenSSL crypto backend (faster on old CPUs lacking AES-NI), you have to install a few dependencies:
apt install libssl-dev gcc pkg-configdnf install openssl-devel gcc pkg-configThen, run:
$ ./build.bash
$ mkdir cipher plain
$ ./gocryptfs -init cipher
$ ./gocryptfs cipher plain
See the Quickstart page for more info.
The MANPAGE.md describes all available command-line options.
$ mkdir cipher plain
$ ./gocryptfs -reverse -init plain
$ ./gocryptfs -reverse plain cipher
The SiriKali project supports gocryptfs and runs on Linux and OSX.
cppcryptfs on Windows provides its own GUI.
If you want to call gocryptfs from your app or script, see CLI_ABI.md for the official stable ABI. This ABI is regression-tested by the test suite.
file-format.md contains a more detailed description.
Since version 0.7.2, gocryptfs is as fast as EncFS in the default mode, and significantly faster than EncFS' "paranoia" mode that provides a security level comparable to gocryptfs.
On CPUs without AES-NI, gocryptfs uses OpenSSL through a thin wrapper called stupidgcm.
This provides a 4x speedup compared to Go's builtin AES-GCM
implementation. See CPU-Benchmarks
for details, or run gocryptfs -speed to see the encryption performance of your CPU.
Example for a CPU with AES-NI:
$ ./gocryptfs -speed
gocryptfs v2.2.0-beta1-5-g52b0444-dirty; go-fuse v2.1.1-0.20210825171523-3ab5d95a30ae; 2021-09-14 go1.17.1 linux/amd64
cpu: Intel(R) Core(TM) i5-3470 CPU @ 3.20GHz; with AES acceleration
AES-GCM-256-OpenSSL 862.79 MB/s
AES-GCM-256-Go 997.71 MB/s (selected in auto mode)
AES-SIV-512-Go 159.58 MB/s
XChaCha20-Poly1305-OpenSSL 729.65 MB/s
XChaCha20-Poly1305-Go 843.97 MB/s (selected in auto mode)
You can run ./benchmark.bash to run gocryptfs' canonical set of
benchmarks that include streaming write, extracting a linux kernel
tarball, recursively listing and finally deleting it. The output will
look like this:
$ ./benchmark.bash
Testing gocryptfs at /tmp/benchmark.bash.xFD: gocryptfs v2.0; go-fuse v2.1.1-0.20210508151621-62c5aa1919a7; 2021-06-06 go1.16.5 linux/amd64
WRITE: 262144000 bytes (262 MB, 250 MiB) copied, 0,698174 s, 375 MB/s
READ: 262144000 bytes (262 MB, 250 MiB) copied, 0,268916 s, 975 MB/s
UNTAR: 8,970
MD5: 4,846
LS: 1,851
RM: 2,367
cipherSize X: incomplete last block (Y bytes), padding to Z bytes
(harmless but annoying, #951)test-without-openssl.bash trying to build tests with openssl enabled
(2ebd0d754b8ee4)-force_owner not allowing file/dir create ( https://github.com/rfjakob/gocryptfs/issues/783 )TestBtrfsQuirks if mkfs.btrfs is not installed ( https://github.com/rfjakob/gocryptfs/issues/930 )go install failing with g: malformed file path "tests/fsck/malleable_base64/27AG8t-XZH7G9ou2OSD_z\ng": invalid char '\n'
(c80558)syscallcompat.Setreuid (and friends) wrappers
(6b1ba584)golang.org/x/sys again-reverse mode affecting the virtual gocryptfs.diriv and
gocryptfs.longname.*.name files. The bug can cause file names to become
undecryptable. To make sure that sync tools like rsync copy new, good copies,
gocryptfs v2.5.0 and later advance ctime and mtime for these files by 10 seconds.
-reverse mode sometimes (triggered by inode number reuse) returning stale
data for gocryptfs.diriv (#802)-reverse mode hardlinking gocryptfs.longname.*.name files of hardlinked
files together (#802)-reverse mode ignoring -force-owner (#809)-ctlsock: automatically delete orphaned colliding socket file (#776)-fido2-assert-option (#807)-init now accepts -masterkey-passwd now ignores -extpass and -passfile for the new password (#287, #882)mount(2) syscall before falling back to fusermount(1). This means we
don't need fusermount(1) at all if running as root or in a root-like namespace
(#697)-extpass mis-parsing commas (#730)rm -R mis-reporting write-protected directory on gocryptfs on sshfs
(commit)debug.ReadBuildInfo() to provide some
version information even when not built with build.bash (#701) .logger process to be killed when started from xfce4-terminal,
and that terminal window was closed (#660,
commit).read-only file system (#690)-longnamemax flag to -init (#499).
Can be used to work around file or path length restrictions on online storage.
See the man page
for details.NO_COLOR env variable (#617)-force_owner not not affecting socket files (#629gocryptfs.conf in reverse mode (commit)-force_owner only taking effect after 2 seconds (#609).
This was a regression introduced in v2.0.date: illegal option -- - when SOURCE_DATE_EPOCH is set
(#570)-init: suggest xchacha on CPUs without AES acceleration (commit)-info: add contentEncryption to output-deterministic-names: new option for -init, both for reverse and forward mode.
Disables file name randomisation & gocryptfs.diriv files
(#151, #402, #592)
-xchacha: new option for -init (forward mode only). Selects XChaCha20-Poly1305 for content encryption.
Gives much better performance on CPUs without AES acceleration
(#452).
gocryptfs -speed what is fastest for your CPU, or read here-serialize_reads: get rid of delay logic by taking advantage of the kernel flag
FUSE_CAP_ASYNC_READ
(go-fuse commit,
gocryptfs commit)-devrandom flag a no-op (commit)-forcedecode flag a no-op (commit)-fido2: do not request PIN on gocryptfs -init fixing FIDO_ERR_UNSUPPORTED_OPTION with YubiKey
(#571)-sharedstorage: present stable inode numbers, fixing getcwd failures
(#584)-badname: make it possible to access content of invalid file names (#568).
Thanks @DerDonut!gocryptfs.diriv caching to fix exponential runtime with deep directories
(commit])-reverse: implement -one-file-system (#475)-reverse: allow exclude-all-but (#588)
gocryptfs -reverse -exclude-wildcard '*' -exclude-wildcard '!/my-important-files' /home/user /mnt/user.encryptedpanic: using reserved ID 1 on ExFAT (#585)pflag cli parsing library to support flags and arguments in any order
(#590)-acl to enable) (#536)RENAME_EXCHANGE and RENAME_WHITEOUT (broken as discovered by fuse-xfstest/gocryptfs-2019-12)-idle: count cwd inside the mount as busy (#533)gocryptfs.diriv and gocryptfs.xxx.name files world-readable to make encrypted backups easier
when mounting via /etc/fstab (#539)gocryptfs -fsck but otherwise ignoredgocryptfs-xray in binary releases (#496)-sharedstorage and also without.
(commit 1,
commit 2,
#549)-fido2, #505)-encrypt-paths / -decrypt-paths functionality to gocryptfs-xray
(#416)-passfiles
(#288)-masterkey=stdin work together with -passwd
(#461)Unknown opcode 2016 crash on Google Cloud
(go-fuse #276,
gocryptfs commit ec74d1d).nfsXXX temporary files
(#367)-nonempty for fusermount3
(#440)--buildmode=pie (#460)gocryptfs -speed: add XChaCha20-Poly1305-Go
(#452)GOMAXPROCS environment variable
(commit ff210a06f--exclude-wildcard
(#367). Thanks @ekalin!gocryptfs.diriv files with 0440 permissions to make it easier to
share an encrypted folder via a network drive
(#387).
Note: as a security precaution, the owner must still manually
chmod gocryptfs.conf 0440 to allow mounting.nofail option in /etc/fstab-passwd can now change the -scryptn parameter for existing filesystems
(#400)-idle unmounting the filesystem despite recent activity
(#421)-allow_other and -plaintextnames, you should upgrade.
Malicious users could trick gocryptfs into modifying files outside of CIPHERDIR,
or reading files inside CIPHERDIR that they should not have access to.-plaintextnames (disabled per default), these attacks do
not work as symlinks are encrypted.Openat/Unlinkat/Symlinkat/...).-aessiv flag for correctly parsing AES-SIV format files
(#299)-extpass now can be specified multiple times to support arguments containing spaces
(#289)Setreuid to robustly set the owner with allow_other (@slackner,
(commit))-e / -exclude option for reverse mode
(#235,
commit)./build.bash -tags enable_trezor to compile with Trezor supportgocryptfs -init -trezor to create a filesystem locked with a physical Trezor device.-fido2 in gocryptfs v2.0.O_DIRECT
(commit)-fsck function
(#191)-masterkey=stdin functionality
(#218)-dev/-nodev, suid/nosuid, -exec/-noexec,
-ro/-rw flags to make mounting via /etc/fstab possible.
Thanks @mahkoh! (#233,
commit,
commit)logger path issue on SuSE
#225osxfuse: vnode changed generation / Error code -36 issue in go-fuse
(#213,
commit)-allow_other
(issue #177)-plaintextnames
(issue #174)-devrandom command-line option
(commit)-sharedstorage command-line option
(commit,
issue #156)Gopkg.toml file for dep vendoring and reproducible builds
(issue #142).DS_Store files inside CIPHERDIR
(issue #140)$PATH contains the mountpoint
(issue #146)-force_owner option to allow files to be presented as owned by a
different user or group from the user running gocryptfs. Please see caveats
and guidance in the man page before using this functionality.-info option to pretty-print infos about a filesystem.HKDF (enabled by default)== characters)
-serialize_reads command-line option
gocryptfs -speed-ctlsock path sanitization-ctlsock-noprealloc command-line option
gocryptfs.1 in the release tarballAESSIV.-reverse, -aessiv-o foo,bar,baz-style options that are passed at the end of
the command-line, like mount(1) does. All other options must still
precede the passed paths.
-o option had to be renamed. It is now
called -ko. Arguments to -ko are passed directly to the kernel.-passfile command-line option. Provides an easier way to read
the password from a file. Internally, this is equivalent to
-extpass "/bin/cat FILE".-gcmiv128, -emenames, -diriv. These
are now always enabled.-o
-ro
spacemonkeygo/openssl with stupidgcm
stupidgcm.spacemonkeygo/openssl. It also gets us
a 20% performance boost for streaming writes.-openssl=auto is the new default-openssl=true/false overrides the autodetection.-longnames: Enable long file name support (default true)-nosyslog: Print messages to stdout and stderr instead of syslog (default false)-wpanic: Make warning messages fatal (used for testing)-d: Alias for -debug-q: Alias for -quiet-memprofile: Write a memory allocation debugging profile the specified
filebuild.bash script compatible with Go 1.3-gcmiv128: Use 128-bit GCM IVs (default true)-emenames: Enable EME filename encryption (default true)gocryptfs.diriv-diriv: Use the new per-directory IV file name encryption (default true)-scryptn: allows to set the scrypt cost parameter N. This option
can be used for faster mounting at the cost of lower brute-force
resistance. It was mainly added to speed up the automated tests.-plaintextnames: disables filename encryption, added on user request-extpass: calls an external program for prompting for the password-config: allows to specify a custom gocryptfs.conf pathFeatureFlags gocryptfs.conf parameter
-plaintextnames.Overall
Maintained
Code review
Go module
Latest release
Releases this year
(top 24 of 82)
1,801 followers · starred Sep 2019
1,130 followers · starred Apr 2016
177 followers · starred Nov 2018
1,976 followers · starred Jan 2017
Encrypted overlay filesystem written in Go
See the code
An encrypted overlay filesystem written in Go. Official website: https://nuetzlich.net/gocryptfs (markdown source).
[!WARNING]
The website "gocryptfs.com" is not affiliated with the gocryptfs project!
gocryptfs is built on top the excellent go-fuse FUSE library. This project was inspired by EncFS and strives to fix its security issues while providing good performance (benchmarks). For details on the security of gocryptfs see the Security design document.
All tags from v0.4 onward are signed by the gocryptfs signing key. Please check Signed Releases for details.
gocryptfs has reached version 1.0 on July 17, 2016. It has gone through hours and hours of stress (fsstress, extractloop.bash) and correctness testing (xfstests). It is now considered ready for general consumption.
The old principle still applies: Important data should have a backup. Also, keep a copy of your master key (printed at init) in a safe place. This allows you to access the data even if the gocryptfs.conf config file is damaged or you lose the password.
The security of gocryptfs has been audited in March 3, 2017. The audit is available here (defuse.ca).
Linux is gocryptfs' native platform.
Beta-quality macOS support is available, which means most things work fine but you may hit an occasional problem. Check out ticket #15 for the history of macOS support but please create a new ticket if you hit a problem.
For Windows, an independent C++ reimplementation can be found here: cppcryptfs
Standalone tools:
gocryptfs-inspect is Python tool that can decrypt files & file names without using FUSE.
gocryptfs-create-folder is a Python tool can encrypt a directory without using FUSE.
Precompiled binaries that work on all x86_64 Linux systems are available
for download from the github releases page. The fuse package from your
distribution must be installed for mounting to work.
gocryptfs is also available as a package in most distributions. Examples:
apt install gocryptfspacman -S gocryptfsport install gocryptfsSee the Quickstart page for more info.
gocryptfs comes with is own test suite that is constantly expanded as features are
added. Run it using ./test.bash. It takes about 1 minute and requires FUSE
as it mounts several test filesystems.
The stress_tests directory contains stress tests that run indefinitely.
In addition, I have ported xfstests to FUSE, the result is the
fuse-xfstests project. gocryptfs
passes the "generic" tests with one exception, results: XFSTESTS.md
A lot of work has gone into this. The testing has found bugs in gocryptfs as well as in the go-fuse library.
Install Go 1.13 or higher:
apt install golangdnf install golangThen, download the source code and compile:
$ git clone https://github.com/rfjakob/gocryptfs.git
$ cd gocryptfs
$ ./build-without-openssl.bash
This will compile a static binary that uses the Go stdlib crypto backend.
If you want to use the OpenSSL crypto backend (faster on old CPUs lacking AES-NI), you have to install a few dependencies:
apt install libssl-dev gcc pkg-configdnf install openssl-devel gcc pkg-configThen, run:
$ ./build.bash
$ mkdir cipher plain
$ ./gocryptfs -init cipher
$ ./gocryptfs cipher plain
See the Quickstart page for more info.
The MANPAGE.md describes all available command-line options.
$ mkdir cipher plain
$ ./gocryptfs -reverse -init plain
$ ./gocryptfs -reverse plain cipher
The SiriKali project supports gocryptfs and runs on Linux and OSX.
cppcryptfs on Windows provides its own GUI.
If you want to call gocryptfs from your app or script, see CLI_ABI.md for the official stable ABI. This ABI is regression-tested by the test suite.
file-format.md contains a more detailed description.
Since version 0.7.2, gocryptfs is as fast as EncFS in the default mode, and significantly faster than EncFS' "paranoia" mode that provides a security level comparable to gocryptfs.
On CPUs without AES-NI, gocryptfs uses OpenSSL through a thin wrapper called stupidgcm.
This provides a 4x speedup compared to Go's builtin AES-GCM
implementation. See CPU-Benchmarks
for details, or run gocryptfs -speed to see the encryption performance of your CPU.
Example for a CPU with AES-NI:
$ ./gocryptfs -speed
gocryptfs v2.2.0-beta1-5-g52b0444-dirty; go-fuse v2.1.1-0.20210825171523-3ab5d95a30ae; 2021-09-14 go1.17.1 linux/amd64
cpu: Intel(R) Core(TM) i5-3470 CPU @ 3.20GHz; with AES acceleration
AES-GCM-256-OpenSSL 862.79 MB/s
AES-GCM-256-Go 997.71 MB/s (selected in auto mode)
AES-SIV-512-Go 159.58 MB/s
XChaCha20-Poly1305-OpenSSL 729.65 MB/s
XChaCha20-Poly1305-Go 843.97 MB/s (selected in auto mode)
You can run ./benchmark.bash to run gocryptfs' canonical set of
benchmarks that include streaming write, extracting a linux kernel
tarball, recursively listing and finally deleting it. The output will
look like this:
$ ./benchmark.bash
Testing gocryptfs at /tmp/benchmark.bash.xFD: gocryptfs v2.0; go-fuse v2.1.1-0.20210508151621-62c5aa1919a7; 2021-06-06 go1.16.5 linux/amd64
WRITE: 262144000 bytes (262 MB, 250 MiB) copied, 0,698174 s, 375 MB/s
READ: 262144000 bytes (262 MB, 250 MiB) copied, 0,268916 s, 975 MB/s
UNTAR: 8,970
MD5: 4,846
LS: 1,851
RM: 2,367
cipherSize X: incomplete last block (Y bytes), padding to Z bytes
(harmless but annoying, #951)test-without-openssl.bash trying to build tests with openssl enabled
(2ebd0d754b8ee4)-force_owner not allowing file/dir create ( https://github.com/rfjakob/gocryptfs/issues/783 )TestBtrfsQuirks if mkfs.btrfs is not installed ( https://github.com/rfjakob/gocryptfs/issues/930 )go install failing with g: malformed file path "tests/fsck/malleable_base64/27AG8t-XZH7G9ou2OSD_z\ng": invalid char '\n'
(c80558)syscallcompat.Setreuid (and friends) wrappers
(6b1ba584)golang.org/x/sys again-reverse mode affecting the virtual gocryptfs.diriv and
gocryptfs.longname.*.name files. The bug can cause file names to become
undecryptable. To make sure that sync tools like rsync copy new, good copies,
gocryptfs v2.5.0 and later advance ctime and mtime for these files by 10 seconds.
-reverse mode sometimes (triggered by inode number reuse) returning stale
data for gocryptfs.diriv (#802)-reverse mode hardlinking gocryptfs.longname.*.name files of hardlinked
files together (#802)-reverse mode ignoring -force-owner (#809)-ctlsock: automatically delete orphaned colliding socket file (#776)-fido2-assert-option (#807)-init now accepts -masterkey-passwd now ignores -extpass and -passfile for the new password (#287, #882)mount(2) syscall before falling back to fusermount(1). This means we
don't need fusermount(1) at all if running as root or in a root-like namespace
(#697)-extpass mis-parsing commas (#730)rm -R mis-reporting write-protected directory on gocryptfs on sshfs
(commit)debug.ReadBuildInfo() to provide some
version information even when not built with build.bash (#701) .logger process to be killed when started from xfce4-terminal,
and that terminal window was closed (#660,
commit).read-only file system (#690)-longnamemax flag to -init (#499).
Can be used to work around file or path length restrictions on online storage.
See the man page
for details.NO_COLOR env variable (#617)-force_owner not not affecting socket files (#629gocryptfs.conf in reverse mode (commit)-force_owner only taking effect after 2 seconds (#609).
This was a regression introduced in v2.0.date: illegal option -- - when SOURCE_DATE_EPOCH is set
(#570)-init: suggest xchacha on CPUs without AES acceleration (commit)-info: add contentEncryption to output-deterministic-names: new option for -init, both for reverse and forward mode.
Disables file name randomisation & gocryptfs.diriv files
(#151, #402, #592)
-xchacha: new option for -init (forward mode only). Selects XChaCha20-Poly1305 for content encryption.
Gives much better performance on CPUs without AES acceleration
(#452).
gocryptfs -speed what is fastest for your CPU, or read here-serialize_reads: get rid of delay logic by taking advantage of the kernel flag
FUSE_CAP_ASYNC_READ
(go-fuse commit,
gocryptfs commit)-devrandom flag a no-op (commit)-forcedecode flag a no-op (commit)-fido2: do not request PIN on gocryptfs -init fixing FIDO_ERR_UNSUPPORTED_OPTION with YubiKey
(#571)-sharedstorage: present stable inode numbers, fixing getcwd failures
(#584)-badname: make it possible to access content of invalid file names (#568).
Thanks @DerDonut!gocryptfs.diriv caching to fix exponential runtime with deep directories
(commit])-reverse: implement -one-file-system (#475)-reverse: allow exclude-all-but (#588)
gocryptfs -reverse -exclude-wildcard '*' -exclude-wildcard '!/my-important-files' /home/user /mnt/user.encryptedpanic: using reserved ID 1 on ExFAT (#585)pflag cli parsing library to support flags and arguments in any order
(#590)-acl to enable) (#536)RENAME_EXCHANGE and RENAME_WHITEOUT (broken as discovered by fuse-xfstest/gocryptfs-2019-12)-idle: count cwd inside the mount as busy (#533)gocryptfs.diriv and gocryptfs.xxx.name files world-readable to make encrypted backups easier
when mounting via /etc/fstab (#539)gocryptfs -fsck but otherwise ignoredgocryptfs-xray in binary releases (#496)-sharedstorage and also without.
(commit 1,
commit 2,
#549)-fido2, #505)-encrypt-paths / -decrypt-paths functionality to gocryptfs-xray
(#416)-passfiles
(#288)-masterkey=stdin work together with -passwd
(#461)Unknown opcode 2016 crash on Google Cloud
(go-fuse #276,
gocryptfs commit ec74d1d).nfsXXX temporary files
(#367)-nonempty for fusermount3
(#440)--buildmode=pie (#460)gocryptfs -speed: add XChaCha20-Poly1305-Go
(#452)GOMAXPROCS environment variable
(commit ff210a06f--exclude-wildcard
(#367). Thanks @ekalin!gocryptfs.diriv files with 0440 permissions to make it easier to
share an encrypted folder via a network drive
(#387).
Note: as a security precaution, the owner must still manually
chmod gocryptfs.conf 0440 to allow mounting.nofail option in /etc/fstab-passwd can now change the -scryptn parameter for existing filesystems
(#400)-idle unmounting the filesystem despite recent activity
(#421)-allow_other and -plaintextnames, you should upgrade.
Malicious users could trick gocryptfs into modifying files outside of CIPHERDIR,
or reading files inside CIPHERDIR that they should not have access to.-plaintextnames (disabled per default), these attacks do
not work as symlinks are encrypted.Openat/Unlinkat/Symlinkat/...).-aessiv flag for correctly parsing AES-SIV format files
(#299)-extpass now can be specified multiple times to support arguments containing spaces
(#289)Setreuid to robustly set the owner with allow_other (@slackner,
(commit))-e / -exclude option for reverse mode
(#235,
commit)./build.bash -tags enable_trezor to compile with Trezor supportgocryptfs -init -trezor to create a filesystem locked with a physical Trezor device.-fido2 in gocryptfs v2.0.O_DIRECT
(commit)-fsck function
(#191)-masterkey=stdin functionality
(#218)-dev/-nodev, suid/nosuid, -exec/-noexec,
-ro/-rw flags to make mounting via /etc/fstab possible.
Thanks @mahkoh! (#233,
commit,
commit)logger path issue on SuSE
#225osxfuse: vnode changed generation / Error code -36 issue in go-fuse
(#213,
commit)-allow_other
(issue #177)-plaintextnames
(issue #174)-devrandom command-line option
(commit)-sharedstorage command-line option
(commit,
issue #156)Gopkg.toml file for dep vendoring and reproducible builds
(issue #142).DS_Store files inside CIPHERDIR
(issue #140)$PATH contains the mountpoint
(issue #146)-force_owner option to allow files to be presented as owned by a
different user or group from the user running gocryptfs. Please see caveats
and guidance in the man page before using this functionality.-info option to pretty-print infos about a filesystem.HKDF (enabled by default)== characters)
-serialize_reads command-line option
gocryptfs -speed-ctlsock path sanitization-ctlsock-noprealloc command-line option
gocryptfs.1 in the release tarballAESSIV.-reverse, -aessiv-o foo,bar,baz-style options that are passed at the end of
the command-line, like mount(1) does. All other options must still
precede the passed paths.
-o option had to be renamed. It is now
called -ko. Arguments to -ko are passed directly to the kernel.-passfile command-line option. Provides an easier way to read
the password from a file. Internally, this is equivalent to
-extpass "/bin/cat FILE".-gcmiv128, -emenames, -diriv. These
are now always enabled.-o
-ro
spacemonkeygo/openssl with stupidgcm
stupidgcm.spacemonkeygo/openssl. It also gets us
a 20% performance boost for streaming writes.-openssl=auto is the new default-openssl=true/false overrides the autodetection.-longnames: Enable long file name support (default true)-nosyslog: Print messages to stdout and stderr instead of syslog (default false)-wpanic: Make warning messages fatal (used for testing)-d: Alias for -debug-q: Alias for -quiet-memprofile: Write a memory allocation debugging profile the specified
filebuild.bash script compatible with Go 1.3-gcmiv128: Use 128-bit GCM IVs (default true)-emenames: Enable EME filename encryption (default true)gocryptfs.diriv-diriv: Use the new per-directory IV file name encryption (default true)-scryptn: allows to set the scrypt cost parameter N. This option
can be used for faster mounting at the cost of lower brute-force
resistance. It was mainly added to speed up the automated tests.-plaintextnames: disables filename encryption, added on user request-extpass: calls an external program for prompting for the password-config: allows to specify a custom gocryptfs.conf pathFeatureFlags gocryptfs.conf parameter
-plaintextnames.Overall
Maintained
Code review
Go module
Latest release
Releases this year
(top 24 of 82)
1,801 followers · starred Sep 2019
1,130 followers · starred Apr 2016
177 followers · starred Nov 2018
1,976 followers · starred Jan 2017