I'm learning about how to encrypt a file in a computer system.

I'm reading this: https://wiki.archlinux.org/index.php/disk_encryption

Here I found an notation: Cryptographic metadata.

As I know, each file has its inode (https://en.wikipedia.org/wiki/Inode), which includes the metadata of the file.

Now the link above tells me that the tool eCryptfs puts the cryptographic metadata in the header of each encrypted file.

I don't quite understand what it means.


Cryptographic metadata is information needed to encrypt/decrypt the data itself.

For example, when using AES-CTR mode, you need a nonce and counter. This information is not sensitive and can be stored alongside the file, in this case as extra information in the filesystem.

The link you mention has a whole section on cryptographic metadata. They also store:

  • encrypted master key
  • data-encryption-key (per file or per-directory)

So just like metadata is information about the data itself (filename, timestamps, permissions, etc...) cryptographic metadata is anything needed to perform cryptographic operations on the data.

As for the "header" part, eCryptfs stores metadata in the same logical file, before the actual data. Eg: if I encrypt the following file:

| this is my plaintext data |

It will be stored as follows on eCryptfs:

| metadata | cipher text of the data |

The advantage of such a method is that the encryption metadata lives in the same place as the file, so moving the raw file (underlying eCryptfs) carries its encryption information.

You can find more information about the implementation details in this paper.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.