GocryptFS

Another state-of-art tool for encrypted disks on Linux is GocryptFS [3]. GocryptFS also owes its existence to an earlier system that lost its shine for the FOSS community: EncFS.

EncFS came under fire when something happened to it during an audit that should never happen to an encryption solution. The testers detected a vulnerability in the source code that, in the worst case, allowed the key used for encryption to be computed. This danger existed with EncFS especially when attackers got their hands on several versions of the encrypted container. The actual key could then be found out by simple matching and an exclusion procedure. Basically, since this incident, EncFS has been under fire from everyone concerned with security and encryption (Figure 4).

Figure 4: If you install EncFS on Ubuntu, you will see a clear warning. It is better to use GocryptFS, which has fixed EncFS's security problems.

However, Austrian Jakob Unterwurzacher found the idea behind EncFS so convincing that he set about creating a new implementation. In doing so, he worked with the Go programming language, which not only explains the program's name, but also translates to considerable speed advantages in practice compared to the previously used C++. The use of FUSE remains unchanged, so GocryptFS (Figure 5) can be used on any Linux system with an activated FUSE environment.

Figure 5: GocryptFS can create encrypted containers with a virtual mount point in a very short time; you can mount or unmount the containers as needed.

Because FUSE is also available for Windows, GocryptFS also works on Windows systems. With its own wrapper, however, the solution goes by the name of CppcryptFS, and, as the name suggests, the Windows version of GocryptFS is written in C++ instead of Go. MacOS users are less fortunate: macFUSE does exist, but it is not available under a free license. The FOSS community therefore tends to avoid the tool. In the meantime, however, an alternative has been devised that takes GocryptFS to macOS, too, although some special functions have been dropped.

If you don't want to use GocryptFS on the command line, you can turn to SiriKali, which offers a graphical user interface for GocryptFS and its predecessor EncFS.

What GocryptFS Offers

As described, GocryptFS always creates complete, encrypted containers in a file or on a disk. Basically, GocryptFS is designed as an overlay file system. In normal operating mode, you enable a GocryptFS container, write something to it, disable the container again, and then the encrypted content appears as such on the underlying file system. Creating a GocryptFS overlay is quick and easy with the help of the documentation.

GocryptFS offers a second option, known as reverse mode, for storage targets that are implicitly insecure. If you want to store your backups in the cloud, for example, you can activate reverse mode in GocryptFS. Reverse mode exposes the encrypted data directly so that you can copy it to another location.

GocryptFS is about as simple as Veracrypt, however, GocryptFS offers a clear speed advantage. At least subjectively, there are considerable differences when encrypting, and these differences are despite the fact that Veracrypt and GocryptFS support acceleration for the various crypto algorithms in the same way. If you want to manage encrypted data, you will definitely want to take a look at GocryptFS.

Universal GUI: Zulucrypt

The final candidate in this encryptors showcase is a program that does not actually do the encryption work itself. Zulucrypt [4], together with Zulumount, which is included with it, is more concerned with organizing the proliferation of encryption methods available under Linux.

Zulucrypt (Figure 6) promises to unify classic crypt setups with LUKS, Veracrypt, and GocryptFS in a single interface. First and foremost, it is a GUI that integrates and calls the other tools in the background.

Figure 6: Zulucrypt is versatile when it comes to handling the various encryption solutions that the admin has to deal with under Linux.

Zulucrypt is extremely user-friendly. The tool is included with most of the popular Linux distributions and can otherwise easily be installed via the provider's website. Immediately after that, the main window of Zulucrypt reveals how powerful the tool actually is.

In Zulucrypt, you can either create or open LUKS devices with Cryptsetup, create Veracrypt volumes or use existing ones, and mount file systems via FUSE with GocryptFS. Unmounting works in the same way. Zulucrypt relieves the user of the need to deal with the details of the CLI or GUI applications of the individual solutions. Nevertheless, it does not hurt to at least be familiar with the basic features of the individual programs, in case something goes wrong in Zulucrypt that the program itself cannot fix. In everyday operations, however, this kind of incident is likely to be an exception.

All in all, Zulucrypt is a powerful little helper that saves admins a part of the learning curve and efficiently reconciles different encryptors under Linux. Zulucrypt is especially beneficial for people who use, or have to use, more than one encryption solution.