Can I mount eCryptfs with a public key?
You can mount eCryptfs with a public key if you have public key support (pubkey) in your kernel. You first need to generate a public/private keypair. Run ecryptfs-manager, follow the prompts to generate the keypair for the key module of your choosing, start the ecryptfsd daemon, and then specify the key module when mounting. For instance, for the OpenSSL key module, assuming you created your key in /usb-drive/mykey.pem and you want to do a layover mount on /secret, run: # ecryptfsd # mount -t ecryptfs -o key=openssl:keyfile=/usb-drive/mykey.pem /secret /secret Q. Why would I want to use public key anyway? Cryptographic keys derived from passphrases are generally worthless. Most passphrases that people can reasonably remember lack even the strength of a 64-bit symmetric key. The idea behind using a public key is to provide an opportunity for two-factor authentication; for instance, with OpenSSL RSA, the PEM file is “something you have” and the passphrase is “something you know.” Thi
