possible to change the password? about cppcryptfs HOT 8 CLOSED

You currently can't change the password using cppcryptfs.

I might add a change password feature in the future.

As it is, the only way to do change the password is either by using gocryptfs to change it (either by syncing through the cloud or dual booting linux or macos), or by creating a new filesystem with the new password, mounting it and copying all the data from the mounted old filesystem into it.

from cppcryptfs.

for cppcryptfs:
not sure is it the same command as in gocryptfs (see below)
usage: cppcryptfs [OPTIONS]

Mounting:
-m, --mount=PATH mount filesystem located at PATH
-d, --drive=D mount to drive letter D
-p, --password=PASS use password PASS
-P, --saved-password use saved password
-r, --readonly mount read-only
-c, --config=PATH path to config file
-s, --reverse mount reverse filesystem
ref:
https://github.com/bailey27/cppcryptfs

for gocryptfs:

command line CAN change password:
Change password
gocryptfs -passwd [OPTIONS] CIPHERDIR

ref:
https://github.com/rfjakob/gocryptfs/blob/master/Documentation/MANPAGE.md

thanks.

from cppcryptfs.

(tried to use "--password=PASS", seems it cant use to change the password of the container......

thx

from cppcryptfs.

hi~ if have time is it possible to tell me the mechanism behind this? thanks.

I got a bunch of files encrypted with password "IAT", and the config made by cppcryptfs is:
"EncryptedKey": "1FAX7Ih7rqgN9MXv+kyhGh69ZFvc75d4Hw71PDzRuS3bcKQ9IHzrsN5Dq/q64vTShK9FSiMVXB8r0uPygSWB4A==",
"Salt": "M+NN23XfIAH6j/QOUwhiolBau8gF1kYiKlVti5sAuGw=",
"VolumeName": "",
(the non-changed info are hide)

Then I enter linux and use gocryptfs to change the password, i.e. the config file.
The new one using password "WWW":

"EncryptedKey": "KN9vWn2nmcLfP03ZCw0jYRdbMVIKGO0hEhxhRrk5SC+VmG5Ky75wz5H57HZgW3RkZZyZ6n05RvBtdHrxIqhDIw==",
	"Salt": "DobVDo1aKOl1DESvbEUookweOQU4/H0iZ6YwD3+vjlU=",

I do tested that I could now (back in win+cppcryptfs) use password WWW to decrypt those previously encrypted with IAT......

If someone have little time, mind to point me to some reference or explain a little? It may help me from
some data loss I think.

Thank you~

from cppcryptfs.

seems the mechanism is in this page...

https://nuetzlich.net/gocryptfs/forward_mode_crypto/

unless someone really want to say, I will read on my own then, thanks

from cppcryptfs.

You currently can't change the password using cppcryptfs.

I might add a change password feature in the future.

As it is, the only way to do change the password is either by using gocryptfs to change it (either by syncing through the cloud or dual booting linux or macos), or by creating a new filesystem with the new password, mounting it and copying all the data from the mounted old filesystem into it.

that's never been done, right? I cant seem to find it implemented. Is it hard to do? I think I'd very much like an easy option to change the password of an encrypted store.

from cppcryptfs.

I could implement change password. I'd prefer to do this using the command line utility cppcryptfsctl.

Just a note, though.

The data protected by cppcryptfs/gocryptfs is encrypted using a master key that is encrypted in gocryptfs.conf using the password.

If you only change the password, then the data is still encrypted by the same master key. So if somebody got ahold of your old gocryptfs.conf and your old password, then they could still decrypt any new data you add/modify even if you've changed the password.

It's more secure to create a new filesystem using the new password and copy the data there and delete the old data.

I think I'll also add an option for printing the masterkey (like gocryptfs does when you create a filesystem, e.g. to be printed and locked in a file cabinet).

e.g.

cppcryptfsctl --print-masterkey c:\cryptfs
enter password: *******************************
here is your master key. keep it safe
a3d33a5-dd5f3d-987ade-0ff23dss......

I also want to add an option to enter the master key along with the new password.

Scenario: you forgot your password but printed a copy of the masterkey and locked it in a filing cabinet.

You could do something like

cppcryptfsctl --recover c:\cryptedfs

In which case you would get prompted

enter master key: *************************************************************************
enter new password: ****************************
repeat new password: ****************************

In which case cppcryptfs would make a backup of gocryptfs.conf to gocryptfs.conf.bak and then encrypt the master key you entered/pasted with the new password and put it in gocryptfs.conf.

Then after you verify you can mount the fs using the new password, you could delete gocrypfs.conf.bak.

from cppcryptfs.

1.4.3.3 has been released with these capabilities.

https://github.com/bailey27/cppcryptfs/releases

from cppcryptfs.