
\begin{DoxyItemize}
\item infos = Information about fcrypt plugin is in keys below
\item infos/author = Peter Nirschl \href{mailto:peter.nirschl@gmail.com}{\tt peter.\+nirschl@gmail.\+com}
\item infos/licence = B\+S\+D
\item infos/provides = sync filefilter crypto
\item infos/needs =
\item infos/recommends =
\item infos/placements = pregetstorage postgetstorage precommit
\item infos/ordering = sync
\item infos/status = unittest nodep configurable experimental unfinished discouraged
\item infos/metadata =
\item infos/description = File Encryption
\end{DoxyItemize}\hypertarget{md_src_plugins_fcrypt_README_src_plugins_fcrypt_README_md}{}\section{fcrypt Plugin}\label{md_src_plugins_fcrypt_README_src_plugins_fcrypt_README_md}
\subsection*{Introduction}

This plugin enables file based encryption and decryption using G\+P\+G.

This plugin encrypts backend files before the commit is executed (thus {\ttfamily precommit}). The plugin decrypts the backend files before the getstorage opens it (thus {\ttfamily pregetstorage}). After the getstorage plugin has read the backend file, the plugin decrypts the backend file again (thus {\ttfamily postgetstorage}).

\subsection*{Security Considerations}

During decryption the plugin temporarily writes the decrypted plain text to the same directory as the original (encrypted) file. This is a vulnerability as an attacker might have access to the plain text for a short period of time (the time between pregetstorage and postgetstorage calls). The plugin shreds, i.\+e. overwrites, the temporary file with zeroes to reduce the risk of leakage.

If the application crashes parts of the decrypted data may leak.

\subsection*{Dependencies}

This plugin uses parts of the {\ttfamily crypto} plugin.

\subsubsection*{Gnu\+P\+G (G\+P\+G)}

Please refer to crypto.

\subsection*{Restrictions}

Please refer to crypto.

\subsection*{Examples}

You can mount the plugin like this\+: \begin{DoxyVerb}    kdb mount test.ecf /t fcrypt /gpg/key=DDEBEF9EE2DC931701338212DAF635B17F230E8D
\end{DoxyVerb}


If you create a key under {\ttfamily /t} \begin{DoxyVerb}    kdb set /t/a "hello world"
\end{DoxyVerb}


you will notice that you can not read the plain text of {\ttfamily test.\+ecf} because it has been encrypted by G\+P\+G.

But you can still access {\ttfamily /t/a} with {\ttfamily kdb get}\+: \begin{DoxyVerb}    kdb get /t/a
\end{DoxyVerb}


\subsection*{Configuration}

\subsubsection*{G\+P\+G Configuration}

The G\+P\+G Configuration is described in crypto. 