Cryptographic metadata is information needed to encrypt/decrypt the data itself.
For example, when using AES-CTR mode, you need a nonce and counter. This information is not sensitive and can be stored alongside the file, in this case as extra information in the filesystem.
The link you mention has a whole section on cryptographic metadata. They also store:
- encrypted master key
- data-encryption-key (per file or per-directory)
So just like metadata is information about the data itself (filename, timestamps, permissions, etc...) cryptographic metadata is anything needed to perform cryptographic operations on the data.
As for the "header" part, eCryptfs stores metadata in the same logical file, before the actual data. Eg: if I encrypt the following file:
| this is my plaintext data |
It will be stored as follows on eCryptfs:
| metadata | cipher text of the data |
The advantage of such a method is that the encryption metadata lives in the same place as the file, so moving the raw file (underlying eCryptfs) carries its encryption information.
You can find more information about the implementation details in this paper.