Is eCryptfs vulverable when storing known file trees?

Question

I use the standard Ubuntu eCryptfs setup to encrypt my home folder. As far as I can tell it encrypts the files and their names, but the directory hierarchy is essentially the same.

Every git repository contains the same hooks folder with the exact same number of files. The .git usually has the same number of files and folders in it. It should be possible to write a small script that searches for git repositories and tells you which the hooks folder is and so on. Then you have only limited possibilities which hook is which, which might be even so see by the file size.

Then you know the contents of a file and the encrypted version. Would that make cracking the encryption feasible? The only solution is a completely encrypted disk with LUKS?

Answer 1

Known-Plaintext Attack

A known-plaintext attack is a technique for determining the key of an encrypted block of data based up a known plaintext that was encrypted to a known ciphertext. Some modern symmetric encryption algorithms are susceptible to this type of attack. There are also [chosen-plaintext attacks] where the attacker chooses plaintexts to be encrypted to a known ciphertext. This is often to gain knowledge of the encryption scheme, spot patterns in the encryption, or recover the encryption key.

Ubuntu uses AES 128-bit encryption (by default) for encrypting their home directories with eCryptFS. While 128 bits is not the "most secure" option of AES it is more than adequate, and is largely considered to be secure against all known cryptographic attacks. There are no known known-plaintext attacks for AES with any keysize.

I believe its safe to say that your home directory is secure while using eCryptFS. Here is a more detailed explanation on eCryptFS itself.