0
I used to store a random generated keyfile in a SmartCard and TrueCrypt was able to access this keyfile using PKCS #11.
I'm trying EncFS now. Some people complain about it storing some of its encryption data (iterations number, salt, etc) in a plain text XML file. These data are valuable for an adversary to hack it, therefore people suggest saving the file in a secure place.
I had then the idea of storing it in a SmartCard/Token. The XML file has a few bytes over 1KB, so any SmartCard should be able to store it.
The issue is that, usually, these keyfiles are read directly by each app using PKCS #11 API. In Windows I'm using EncFSMP for handling EncFS mounting. It only has a checkbox for setting the config file is external, and a simple Open File Dialog for selecting the file in normal file system. There's no PKCS #11 interface as TrueCrypt has.
Anybody has any idea how this could be made work?
I google and found no solution, I suppose nobody would create a software for mounting a SmartCard as a Windows drive, so that it emulates a file system and any app could read a keyfile using good old fopen().
I believe it would be possible to develop an EncFS GUI as EncFSMP, that supports PKCS #11 and reads the keyfile and provides it as the config XML to EncFS, but of course we'd need somebody with EncFS and PKCS #11 skills to do the job.
If there is another software like eCryptFS that supports SmartCard keyfile I'd also like to know. Found nothing till now, it seems that only TrueCrypt has this feature.
Interesting, thanks for the answer. Anyway, I've read complaints on EncFS for these data be easily accessible, and claiming eCryptFS as more secure because of that. They also suggest hiding this file on a USB drive, and some people seem to do it. Based on those complaints I had the idea of storing this file on a secure place. – Hikari – 2016-01-20T14:03:59.500
Your description remembers me of KeePass, is that what you're suggesting? I already use it. I know it has a PKCS#11 plugin, but have never used it. – Hikari – 2016-01-20T14:04:41.187
If KeePass can access smart card/tokens, then it would be an excellent idea. And I've often heard eCryptFS described as a pgp-based file encryption system, so I would be surprised if they didn't have their salt & count/rounds easily visible too. I think it's just the plaintext
– Xen2050 – 2016-01-20T21:44:42.537.encfs6
file that makes people think it's less secure, just because they can read it with a text editor themselves, forgetting pgp does the same thing. If it's good enough for pgp, it's good enough for me. Here's a Q about hiding salt (probably not the best one, but looks helpful)Well if PGP does the same, so be it. Thanks. – Hikari – 2016-03-18T18:01:51.767