Is it safe to partially sync encrypted folder contents?

[maxkapur]

Suppose I set up a gocryptfs directory inside of a cloud sync tool like Nextcloud, OneDrive, etc.

The plaintext contents of the directory (when mounted locally, outside of the cloud storage) are something like:

plain/
    music/          (500 GB)
    documents/      (100 MB)

and thus the encrypted contents look like this:

cipher/
    80thsdt787s9/       (500 GB)
    sth7743h664/        (100 MB)

To save local disk space, I can configure my Nextcloud client to only sync cipher/sth7743h664/ (which I know, from the file size, is plain/documents/). But will I cause problems in gocryptfs by doing so?

This setup appears to work fine in my local testing, but I'm worried I'm setting up a weird race condition or something down the line.

If there's no risk with this setup, I'd prefer it to having separate volumes because it means I can mount everything with one command/password.

[rfjakob]

This is fine.

Note that, independently of partial or full sync, you can end up with sync conflicts on gocryptfs.diriv when you create the same directory independently on different copies that get synced later.

This is because gocryptfs.diriv gets created with random content every time a directory is created.

Example:

PC 1:

mkdir "Weekend Plans"

Encrypted view:

c5gre65asg/gocryptfs.diriv = "0xdeadbeef...."

PC 2:

mkdir "Weekend Plans"

Encrypted view:

c5gre65asg/gocryptfs.diriv = "0xcafecode...."

After sync:

c5gre65asg/gocryptfs.diriv = "0xdeadbeef...."
c5gre65asg/gocryptfs.diriv (conflict 1) = "0xcafecode...."

[rfjakob]

This scenario does not happen a lot, escecially when you are aware of it. But you can avoid it altogether with -deterministic-names, at the cost of some security:

https://github.com/rfjakob/gocryptfs/blob/master/Documentation/MANPAGE.md#-deterministic-names

[rfjakob]

In any case, you should mount with -sharedstorage to handle some edge cases when files get changed/recreated behind gocryptfs' back:

https://github.com/rfjakob/gocryptfs/blob/master/Documentation/MANPAGE.md#-sharedstorage

[maxkapur]

Awesome, thank you for all these details! I agree, I'm not super worried about the sync conflict issue you mentioned because creating the same file twice tends to cause sync problems even if you are syncing plaintext files.