diff options
| author | Daniel Micay <danielmicay@gmail.com> | 2020-12-24 22:53:31 -0500 |
|---|---|---|
| committer | Daniel Micay <danielmicay@gmail.com> | 2020-12-24 22:53:31 -0500 |
| commit | d3da06814dc706d2f1dd207cbdb6e2e0b6584ee3 (patch) | |
| tree | 575cb7d0f9ce83cd8312228f27ec8d69a6d55b9e /static/faq.html | |
| parent | da9f17b2c8263a4a8928afedabd0113366d42fa9 (diff) | |
document metadata encryption
Diffstat (limited to 'static/faq.html')
| -rw-r--r-- | static/faq.html | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/static/faq.html b/static/faq.html index e0887f6f..e2a82b22 100644 --- a/static/faq.html +++ b/static/faq.html @@ -337,8 +337,11 @@ <p>File data is encrypted with AES-256-XTS and file names with AES-256-CTS. A unique key is derived using HKDF-SHA512 for each regular file, directory and symbolic link from the per-profile encryption keys, or the device encryption - key for non-sensitive data stored outside of profiles. GrapheneOS increases - the file name padding from 16 bytes to 32 bytes.</p> + key for non-sensitive data stored outside of profiles. The directory key is + used to encrypt the file names. GrapheneOS increases the file name padding + from 16 bytes to 32 bytes. AES-256-XTS with the device encryption key is also + used to encrypt filesystem metadata as a whole beyond the finer-grained file + name encryption.</p> <p>The OS derives a password token from the profile's lock method credential using scrypt. This is used as the main input for key derivation.</p> |