Selecting base and mount directories¶

While you can access your files through your mount directory, CryFS actually places them in your base directory after encrypting. CryFS will encrypt and decrypt your files 'on the fly' as they are accessed, so files will never be stored on the disk in unencrypted form.

You can choose any empty directory as your base, but your mount directory should be outside of any cloud storage, as your cloud may try to sync your (temporarily mounted) unencrypted files as well.

Setup and usage of your encrypted directory¶

Creating and mounting your encrypted storage use the same command-line syntax:

cryfs basedir mountpoint

If CryFS detects an encrypted storage in the given base directory, you will be asked for the passphrase to unlock and mount it. Otherwise, CryFS will help you with creating one, just follow the on-screen instructions.

After you are done working with your encrypted files, unmount your storage with the command

cryfs-unmount mountpoint

Changing your passphrase¶

As the encryption key to your CryFS storage is stored in your configuration file, it would be possible to re-encrypt it using a different passphrase (although this feature has not been implemented yet).

However, this does not change the actual encryption key of your storage, so someone with access to the old passphrase and configuration file (for example through the file history of your cloud or your file system) could still access your files, even those created after the password change.

For this reason, the recommended way to change your passphrase is to create a new CryFS storage with the new passphrase and move your files from the old to the new one.

Getting help¶

-h, --help

Show a help message containing short descriptions for all options.

--show-ciphers

Show a list of all supported encryption ciphers.

--version

Show the CryFS version number.

Encryption parameters¶

--blocksize arg

Set the block size to arg bytes. Defaults to 32768.

A higher block size may help reducing the file count in your base directory (especially when storing large files), but will also waste more space when storing smaller files.

--cipher arg

Use arg as the cipher for the encryption. Defaults to aes-256-gcm.

-c file, --config file

Use file as configuration file for this CryFS storage instead of basedir/cryfs.config

General options¶

-f, --foreground

Run CryFS in the foreground. Stop using CTRL-C.

--allow-filesystem-upgrade

Allow upgrading the file system if it was created with an old CryFS version. After the upgrade, older CryFS versions might not be able to use the file system anymore.

--allow-integrity-violations

By default, CryFS checks for integrity violations, i.e. will notice if an adversary modified or rolled back the file system. Using this flag, you can disable the integrity checks. This can for example be helpful for loading an old snapshot of your file system without CryFS thinking an adversary rolled it back.

--allow-replaced-filesystem

By default, CryFS remembers file systems it has seen in this base directory and checks that it didn't get replaced by an attacker with an entirely different file system since the last time it was loaded. However, if you do want to replace the file system with an entirely new one, you can pass in this option to disable the check.

--create-missing-basedir

Creates the base directory even if there is no directory currently there, skipping the normal confirmation message to create it later.

--create-missing-mountpoint

Creates the mountpoint even if there is no directory currently there, skipping the normal confirmation message to create it later.

--missing-block-is-integrity-violation=true

When CryFS encounters a missing ciphertext block, it cannot cannot (yet) know if it was deleted by an unauthorized adversary or by a second authorized client. This is one of the restrictions of the integrity checks currently in place. You can enable this flag to treat missing ciphertext blocks as integrity violations, but then your file system will not be usable by multiple clients anymore. By default, this flag is disabled.

--logfile file

Write status information to file. If no logfile is given, CryFS will write them to syslog in background mode, or to stdout in foreground mode.

--unmount-idle arg

Unmount automatically after arg minutes of inactivity.