{"action":"created","issue":{"url":"https://api.github.com/repos/vgough/encfs/issues/279","repository_url":"https://api.github.com/repos/vgough/encfs","labels_url":"https://api.github.com/repos/vgough/encfs/issues/279/labels{/name}","comments_url":"https://api.github.com/repos/vgough/encfs/issues/279/comments","events_url":"https://api.github.com/repos/vgough/encfs/issues/279/events","html_url":"https://github.com/vgough/encfs/pull/279","id":204160370,"number":279,"title":"Support paranoia set-up in reverse mode","user":{"login":"danim7","id":25306294,"avatar_url":"https://avatars0.githubusercontent.com/u/25306294?v=4","gravatar_id":"","url":"https://api.github.com/users/danim7","html_url":"https://github.com/danim7","followers_url":"https://api.github.com/users/danim7/followers","following_url":"https://api.github.com/users/danim7/following{/other_user}","gists_url":"https://api.github.com/users/danim7/gists{/gist_id}","starred_url":"https://api.github.com/users/danim7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/danim7/subscriptions","organizations_url":"https://api.github.com/users/danim7/orgs","repos_url":"https://api.github.com/users/danim7/repos","events_url":"https://api.github.com/users/danim7/events{/privacy}","received_events_url":"https://api.github.com/users/danim7/received_events","type":"User","site_admin":false},"labels":[{"id":116845803,"url":"https://api.github.com/repos/vgough/encfs/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2017-01-30T23:22:00Z","updated_at":"2018-03-11T13:03:37Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/vgough/encfs/pulls/279","html_url":"https://github.com/vgough/encfs/pull/279","diff_url":"https://github.com/vgough/encfs/pull/279.diff","patch_url":"https://github.com/vgough/encfs/pull/279.patch"},"body":"I propose this pull request to support paranoia set-up in reverse mode (read-only)\r\n\r\nThis closes #273 (and potentially others)\r\nThis is my first contribution to a open-source project ever....I hope I'm doing it right :)\r\n\r\nTo enable paranoia set-up in reverse mode, it is necessary to:\r\na. Support Filename IV chaining\r\nb. Support External IV chaining\r\nc. Support Block MAC headers in files\r\n\r\nThe point (a) and (b) work just out of the box when the controls avoiding using them in reverse mode are disabled.\r\nThis pull request includes support for point (c).\r\n\r\nThe tests done are:\r\n# \r\n**a. Chech Filename IV chaining**\r\n1. Mount paranoia in reverse mode: \r\n`encfs --reverse /media/encfs/plaintext /media/encfs/ciphertext`\r\n\r\n2. Create two plaintext files with same filename in different folders:\r\n```\r\ncd /media/encfs/plaintext\r\nmkdir d1 d2\r\necho aa > d1/aa\r\necho aa > d2/aa\r\n```\r\n3. Check both files are encoded with different names:\r\n```\r\ncd /media/encfs/ciphertext\r\nll  *\r\n\r\n```\r\n**Result**: OK, same plaintext filenames ciphered to different filenames in different folders\r\n# \r\n**b. Check External IV chaining**\r\n\r\n1. Mount paranoia in reverse mode: \r\n`encfs --reverse /media/encfs/plaintext /media/encfs/ciphertext`\r\n\r\n2. Create a file:\r\n```\r\ncd /media/encfs/plaintext\r\necho aa > aa\r\n```\r\n\r\n3. Get checksum of ciphered file:\r\n```\r\ncd /media/encfs/ciphertext\r\nsha1sum *\r\n```\r\n\r\n4. Rename plaintext file: \r\n```\r\ncd /media/encfs/plaintext\r\nmv aa bb\r\n```\r\n\r\n5. Get checksum of ciphered file:\r\n```\r\ncd /media/encfs/ciphertext\r\nsha1sum *\r\n```\r\n\r\n6. Rename plaintext file to original filename:\r\n```\r\ncd /media/encfs/plaintext\r\nmv bb aa\r\n```\r\n\r\n7. Get checksum of ciphered file:\r\n```\r\ncd /media/encfs/ciphertext\r\nsha1sum *\r\n```\r\n\r\n**Result**: OK, when a plaintext file is renamed, its ciphered filename and contents change. When it is renamed back to the original filename, the ciphered filename and contents are back to the original values.\r\n# \r\n**c. Check MAC headers**\r\n\r\n1. Mount paranoia in reverse mode:\r\n`encfs --reverse /media/encfs/plaintext /media/encfs/ciphertext`\r\n\r\n2. Create a file in the plaintext folder:\r\n```\r\ncd /media/encfs/plaintext\r\necho aa > aa\r\n```\r\n\r\n3. Copy the ciphered file to a new folder:\r\n```\r\ncd /media/encfs/ciphertext\r\ncp * /media/encfs/copy_of_ciphertext\r\n```\r\n\r\n4. Copy the config file of step 1 to the new folder:\r\n`cp /media/encfs/plaintext/.encfs6.xml /media/encfs/copy_of_ciphertext`\r\n\r\n5. Mount it in normal mode:\r\n`encfs /media/encfs/copy_of_ciphertext /media/encfs/copy_of_plaintext`\r\n\r\n6. Check sha1sum of original and copied files:\r\n`sha1sum /media/encfs/plaintext/aa /media/encfs/copy_of_plaintext/aa`\r\n\r\n7. Modify copied cipherfile:\r\n`echo a >> /media/encfs/copy_of_ciphertext/*`\r\n\r\n8. Check sha1sum of original and copied files:\r\n`sha1sum /media/encfs/plaintext/aa /media/encfs/copy_of_plaintext/aa`\r\n\r\n**Result**: OK, the check in step 6 matches. The check after altering the cipherfile shows an IO error\r\n# \r\n**d. Non Regression Tests**\r\n\r\n1. Mount paranoia in reverse mode:`\r\nencfs --reverse /media/encfs/plaintext /media/encfs/ciphertext`\r\n\r\n2. Extract and get SHA1 checksum of linux kernel sources (example with lots of different files):\r\n```\r\ncd /media/encfs/plaintext\r\ntar xvf linux-4.9.5.tar.xz\r\nrhash -r -H * > SHA1SUM\r\n```\r\n\r\n3. Copy ciphered files to a new folder:\r\n```\r\ncd /media/encfs/copy_of_ciphertext\r\ncp -R /media/encfs/ciphertext/* .\r\n```\r\n\r\n4. Copy the config file of step 1 to the new folder:\r\n`cp /media/encfs/plaintext/.encfs6.xml /media/encfs/copy_of_ciphertext`\r\n\r\n5. Mount it in normal mode:\r\n`encfs /media/encfs/copy_of_ciphertext /media/encfs/copy_of_plaintext`\r\n\r\n6. Check SHA1SUM of all copied files:\r\n```\r\ncd /media/encfs/copy_of_plaintext\r\nrhash -c SHA1SUM\r\n```\r\n\r\n**Result**: OK, SHA1SUM of all files is correct\r\n"},"comment":{"url":"https://api.github.com/repos/vgough/encfs/issues/comments/372113914","html_url":"https://github.com/vgough/encfs/pull/279#issuecomment-372113914","issue_url":"https://api.github.com/repos/vgough/encfs/issues/279","id":372113914,"user":{"login":"danim7","id":25306294,"avatar_url":"https://avatars0.githubusercontent.com/u/25306294?v=4","gravatar_id":"","url":"https://api.github.com/users/danim7","html_url":"https://github.com/danim7","followers_url":"https://api.github.com/users/danim7/followers","following_url":"https://api.github.com/users/danim7/following{/other_user}","gists_url":"https://api.github.com/users/danim7/gists{/gist_id}","starred_url":"https://api.github.com/users/danim7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/danim7/subscriptions","organizations_url":"https://api.github.com/users/danim7/orgs","repos_url":"https://api.github.com/users/danim7/repos","events_url":"https://api.github.com/users/danim7/events{/privacy}","received_events_url":"https://api.github.com/users/danim7/received_events","type":"User","site_admin":false},"created_at":"2018-03-11T13:03:37Z","updated_at":"2018-03-11T13:03:37Z","author_association":"NONE","body":"Hello @benrubson\n\nIt has been a while since I worked with encfs, and I may be wrong about\nthis, but I don't think it is a easy change.\n\nYou will have to get a whole block to be able to compute the MAC\nsuccessfully. That means you will need some kind of buffering before\nwriting a block, to treat the cases where an application or the operating\nsystem gives you a partial block.\n\nAnother particular case would be if an application writes a partial block\non purpose, expecting you will write it to disk. In that case, you will\nhave to read the whole block from disk, modify it partially, recheck the\nMAC and write it if successful.\n\nI don't know how you may choose one or the other write strategy at the\nencfs level...there are quite a few corner cases.\n\nUnfortunately I have almost no free time right now... Please feel free to\nmodify the pull request (maintainers shall be allowed to do it) or pull\nfrom my repository ;)\n\nThanks !\n"}}
{"actor":{"display_login":"danim7"}}