Post Migrated Away to by Rory Alsop
    Post Locked by Community
    Post Closed as "off topic" by Rory Alsop
source | link

Information leakage from the ecryptfs filesystem

I'm wondering what information might be leaked from the ecryptfs filesystem. This is what Ubuntu uses if you check the box for "encrypted home directory" when using the desktop installer, so is probably quite widely used. Key characteristics of it:

  • each file is encrypted individually and stored in the underlying filesystem
  • each file is padded in size to be a multiple of 4096 bytes, with a minimum of 12288 (except for directories and soft links)
  • file and directory names are encrypted
  • the directory structure is maintained

(Note I haven't found a spec about the above, this is worked out from observing my own filesystem - it's stored in /home/.ecryptfs/USERNAME/.Private if you want to examine your own).

So assuming you can't break the encryption keys then you can't examine the contents of the files. However there is still some information left to examine, and just as traffic analysis can deduce useful information from encrypted communications data, I'm wondering how much someone might be able to work out from the directory structure and approximate file sizes.

Certainly you could work out which directories and files contained music, video and photographs from file size. You might even be able to work out what music and videos existed. You could probably work out some of the applications in use due to their pattern of config/cache directories - firefox vs chrome etc.

Is there anything else? Is there a standard analysis of what could be deduced? Does anything else spring to mind?

(I must admit I assumed there was no padding of file sizes when I started writing this question - I'm reassured that there is).