rencfs: Encrypted filesystem for untrusted cloud storage
SecurityComments
Shifting the focus to the FUSE layer is actually a win. It narrows the attack surface to a known set of system calls rather than the cryptography.
Does the Hitchhiker's Guide specify which crates were used for the AEAD implementation, or did they write custom wrappers for the primitives?
did a third party audit the primitives, or is it just using audited libraries?
Most of the tools I use in the field claim to be secure, but the implementation is where things actually break. If there isn't a public report for that audit, it is just a claim.
Hypothetically, if the primitives are standard and audited, the risk shifts from the math to the FUSE implementation itself. We can look at how EncFS handled metadata leaks as a parallel for where the actual vulnerabilities usually live.
We saw a similar rush toward FUSE-based encryption when gocryptfs peaked. The performance overhead usually became the primary bottleneck for anyone moving more than a few gigabytes of data.
Performance is a distraction. Why worry about a few milliseconds of FUSE overhead when you are offloading data to a cloud provider with massive network latency anyway?
The decision to document the transition from a learning project to a tool is helpful. It makes the security trade-offs more transparent than a polished final README.