gocryptfs -init -xchacha: Cannot read decrypted files on cppcryptfs

[magnemann]

Hi,
On Archlinux, I init a new fs on a ntfs-partition.

gocryptfs -init -xchacha -deterministic-names -raw64 /run/media/magne/tbox/diamant-magne/

The config look like this:

{
"Creator": "gocryptfs v2.3",
"EncryptedKey": "thekeygoeshere",
"ScryptObject": {
"Salt": "thesaltgoeshere",
"N": 65536,
"R": 8,
"P": 1,
"KeyLen": 32
},
"Version": 2,
"FeatureFlags": [
"HKDF",
"XChaCha20Poly1305",
"EMENames",
"LongNames",
"Raw64"
]
}

Then I mount it:

magne@rawjo /r/m/m/t/diamant-magne> gocryptfs /run/media/magne/tbox/diamant-magne/ /mnt/gm-clear/
Password:
Decrypting master key
Filesystem mounted and ready.

Then I copy some files to it, and all seems normal. I can read and modify the files.

The the scary part starts. I switch to windows10 and fire up cppcryptfs.
When I try to mount, I get

So I remove that flag in config file and try again.
I get:

I add the flag and finally it mounts. I can see the files and the decrypted filenames.
But when I try to open a file i get read error, depending on filetype:

Does anyone have a tip for me? Thanks a lot. 😃

Read Error.
Data could not be read from the file.

[rfjakob]

Looks like cppcryptfs does not support -xchacha. You need to run gocryptfs -init without that flag.

[rfjakob]

Also, you should rather not mess around with your gocryptfs.conf like that :)

Doing that means that gocryptfs.conf does not match the actually encrypted files anymore, which is NOT SO GOOD (tm).

[magnemann]

Tried again without -xchacha, works like a charm now!
I thought gocryptfs.conf contained options on how to mount. I try to keep my fingers off that file.
Thanks!

[rfjakob]

So, gocryptfs.conf has the info on how the files are encrypted. Any mount options (like --quiet etc) must be passed on the command line each time, these are not saved.