)]}'
{
  "commit": "9c79f34f7ee71cd28272332b424ca64b2be006ab",
  "tree": "1a818b78d8f0497c4b97a77a6464718dfaaf12c1",
  "parents": [
    "14bca6c39d8245a0313f55309bfeb6bf60cc17c8"
  ],
  "author": {
    "name": "Michael Halcrow",
    "email": "mhalcrow@us.ibm.com",
    "time": "Tue Jan 06 14:41:57 2009 -0800"
  },
  "committer": {
    "name": "Linus Torvalds",
    "email": "torvalds@linux-foundation.org",
    "time": "Tue Jan 06 15:59:21 2009 -0800"
  },
  "message": "eCryptfs: Filename Encryption: Tag 70 packets\n\nThis patchset implements filename encryption via a passphrase-derived\nmount-wide Filename Encryption Key (FNEK) specified as a mount parameter.\nEach encrypted filename has a fixed prefix indicating that eCryptfs should\ntry to decrypt the filename.  When eCryptfs encounters this prefix, it\ndecodes the filename into a tag 70 packet and then decrypts the packet\ncontents using the FNEK, setting the filename to the decrypted filename.\nBoth unencrypted and encrypted filenames can reside in the same lower\nfilesystem.\n\nBecause filename encryption expands the length of the filename during the\nencoding stage, eCryptfs will not properly handle filenames that are\nalready near the maximum filename length.\n\nIn the present implementation, eCryptfs must be able to produce a match\nagainst the lower encrypted and encoded filename representation when given\na plaintext filename.  Therefore, two files having the same plaintext name\nwill encrypt and encode into the same lower filename if they are both\nencrypted using the same FNEK.  This can be changed by finding a way to\nreplace the prepended bytes in the blocked-aligned filename with random\ncharacters; they are hashes of the FNEK right now, so that it is possible\nto deterministically map from a plaintext filename to an encrypted and\nencoded filename in the lower filesystem.  An implementation using random\ncharacters will have to decode and decrypt every single directory entry in\nany given directory any time an event occurs wherein the VFS needs to\ndetermine whether a particular file exists in the lower directory and the\ndecrypted and decoded filenames have not yet been extracted for that\ndirectory.\n\nThanks to Tyler Hicks and David Kleikamp for assistance in the development\nof this patchset.\n\nThis patch:\n\nA tag 70 packet contains a filename encrypted with a Filename Encryption\nKey (FNEK).  This patch implements functions for writing and parsing tag\n70 packets.  This patch also adds definitions and extends structures to\nsupport filename encryption.\n\nSigned-off-by: Michael Halcrow \u003cmhalcrow@us.ibm.com\u003e\nCc: Dustin Kirkland \u003cdustin.kirkland@gmail.com\u003e\nCc: Eric Sandeen \u003csandeen@redhat.com\u003e\nCc: Tyler Hicks \u003ctchicks@us.ibm.com\u003e\nCc: David Kleikamp \u003cshaggy@us.ibm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "6046239465a147f28a8227ae075472c3bafd2757",
      "old_mode": 33188,
      "old_path": "fs/ecryptfs/crypto.c",
      "new_id": "485732751f097b067c7ead175fcae2a844a118ff",
      "new_mode": 33188,
      "new_path": "fs/ecryptfs/crypto.c"
    },
    {
      "type": "modify",
      "old_id": "a75026d35d1620ba6986affb8149384d10c66f6c",
      "old_mode": 33188,
      "old_path": "fs/ecryptfs/ecryptfs_kernel.h",
      "new_id": "76a95bd8819b72529e0df3e1befbb3bf3ccd2b2d",
      "new_mode": 33188,
      "new_path": "fs/ecryptfs/ecryptfs_kernel.h"
    },
    {
      "type": "modify",
      "old_id": "0d713b6919411375b4831c4e8c0f89419dfbd767",
      "old_mode": 33188,
      "old_path": "fs/ecryptfs/keystore.c",
      "new_id": "dafceb5560e5682c11cc005c0c80adf307c6ae7a",
      "new_mode": 33188,
      "new_path": "fs/ecryptfs/keystore.c"
    }
  ]
}