Bijou is a tiny yet fast encrypted file system.

Related tags

Cryptography bijou
Overview

Bijou ✨💎✨

Bijou (['bi:ʒu], French for "jewel") is a tiny yet fast encrypted filesystem, built upon RocksDB.

Bijou provides a FUSE interface, as well as Rust API (bijou-core) to manipulate the filesystem.

Why Bijou?

The initial motivation of Bijou is to provide access to encrypted filesystem everywhere, without extra requirement for the host system. Most of currently available encrypted filesystems just rely on the underlying filesystem to do the most of the work (directory structure, filenames, metadata, xattrs, etc.), which both limits the portability and compromises the security.

Bijou is developed with safety and performance in mind. Almost all metadata is stored in a RocksDB database, which is patched to support at-rest encryption. Because of that, Bijou poses minimum requirement on the underlying filesystem. In addition, an abstraction of the storage layer makes it possible to store file contents nearly everywhere, including local file system, OpenDAL (experimental) or even RocksDB itself.

Warning

Bijou is under active development and is not ready for production use. It's unstable (may crash!) and on-disk format may change. You definitely don't want to use it to store your important data for now.

Features

  • File encryption with integrity check
  • Cross platform filesystem features: (hard or soft) links, xattrs, file permissions
  • Directory structure encryption
  • Customizable storage layer
  • Rust API
  • Filenames with arbitrary length

Currently Bijou is only tested on Linux, but it should work on other platforms as well.

Performance

The following benchmark is done on a 14-core Intel i7-12700H CPU with 32GB RAM and a 1T NVMe SSD.

Baseline Bijou gocryptfs Cryptomator securefs1 encfs
Tested Version N/A commit 823bf69 commit 8b1c4b0 v1.9.3 v0.14.3 v1.9.5
Seq Read 1748MB/s 1134MB/s 655MB/s 1084MB/s 643MB/s 342MB/s
Seq Write 1351MB/s 1251MB/s 506MB/s 605MB/s 169MB/s 137MB/s
Random Read 605MB/s 244MB/s 36MB/s 134MB/s 42MB/s 26MB/s
Random Write 270MB/s 123MB/s 23MB/s 62MB/s 24MB/s 18MB/s
untar linux-3.0 1.7s ± 0.03s 7.3s ± 2.4s 7.1s ± 0.3s 12.7s ± 0.5s 5.1s ± 0.4s 7.8s ± 0.3s
ls -lR linux-3.0 115.7ms ± 2.4ms 263.4ms ± 243.7ms 1.3s ± 0.06s 2.4s ± 0.3s 220.3ms ± 17.8ms 2.0s ± 0.2s

Bijou might be slower in cases where directory structure or file metadata is frequently accessed since they are stored in a separate database. However, Bijou still outperforms other filesystems in most cases.

Security & Design

See security and design for more information.

Get Involved

Bijou is still in its early stage, and there are many things to do. If you're interested in this project, check out CONTRIBUTING.md. Any contribution is welcome!

Installation

cargo install --git https://github.com/Mivik/bijou

Usage

# Create a database
bijou create <data-dir>

# Mount it
bijou mount <data-dir> <mountpoint>

See bijou --help for more information.

License

Licensed under the Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0

Footnotes

  1. securefs does not support O_DIRECT flag, and is tested without it

You might also like...
Smarter brute-force password searching for PKZIP encrypted files

Zip Blitz Motivation This program was created for a very specfic problem I had. I had a large encrypted zip file that I lost/forgot the password for.

An HTTP proxy for assets (mainly images) to route requests through an always-encrypted connection.

camo-rs camo-rs is a frontend-compatible Rust-re-implementation of the now archived NodeJS-based atmos/camo - an HTTP proxy for assets (mainly images)

A simple key-value store with a log-structured, append-only storage architecture where data is encrypted with AES GCM.

akvdb A simple key-value store with a log-structured, append-only storage architecture where data is encrypted with AES GCM. Modified from the actionk

Koofr Vault is an open-source, client-side encrypted folder for your Koofr cloud storage offering an extra layer of security for your most sensitive files.

Koofr Vault https://vault.koofr.net Koofr Vault is an open-source, client-side encrypted folder for your Koofr cloud storage offering an extra layer o

A tiny blockchain for demonstraion.
A tiny blockchain for demonstraion.

tinychain Substrate入门课 Office Hour 演示项目。 项目介绍 本项目旨在介绍区块链基本原理,重点关注如何生成区块和如何与其他节点达成共识,会简化其他逻辑。 只有转账功能,不包含智能合约,也不包含Substrate相关内容 共识机制:PoW 网络协议:使用HTTP模拟P2

Tiny CLI for submitting large calldata transactions to EVM networks to stress test the networking layer. Main motivation: EIP4844blobs.

stress4844 Tiny CLI for submitting large calldata transactions to EVM networks to stress test the networking layer. Main motivation: EIP4844 blobs. ca

Tiny CLI for submitting large calldata transactions to EVM networks to stress test the networking layer

Tiny CLI for submitting large calldata transactions to EVM networks to stress test the networking layer. Main motivation: EIP4844blobs.

Tiny media transcoding utility for node 🎶

Mediaplex Tiny media transcoding utility for node. 🏗️ This package is a work in progress. Installation $ npm install --save mediaplex Example const m

Yet another gem miner

Rusty Pickaxe Multithreaded CPU miner for Provably Rare Gems, written in Rust. There is also closed-source GPU version, waiting to be released. Config

Owner
Mivik
Mivik
Program to determine the password of an encrypted ZIP file via dictionary attack.

zip-dict-attack Program to determine the password of an encrypted ZIP file via dictionary attack. Inspired by this article. Usage Cargo is used to bui

null 2 Oct 8, 2022
An encrypted multi client messaging system written in pure Rust

?? Preamble This is a pure Rust multi-client encrypted messaging system, also known as Edode's Secured Messaging System. It is an end-to-end(s) commun

Edode 3 Sep 16, 2022
Dione is an anonymize and encrypted messaging system build on top on a peer to peer layer.

Secure and Anonymous Messaging WARNING: Currently Dione is not ready to be used nor does it fulfill its goal of being an anonymous messenger. In order

Dione 41 Jan 5, 2023
rustic_core - library for fast, encrypted, deduplicated backups that powers rustic-rs

Library for fast, encrypted, and deduplicated backups About This library is powering rustic-rs. A backup tool that provides fast, encrypted, deduplica

rustic 9 Sep 29, 2023
a handy utility to work with encrypted DMGs

edmgutil edmgutil is a simple wrapper utility to hdiutil to help you work with disposable, encrypted DMGs. It can decompress an encrypted ZIP into a n

Sentry 9 Nov 29, 2022
Encrypted memories

Diary - Encrypted memories Diary is a TUI program written in Rust for GNU/Linux / *BSD / Android (It probably works on other platforms too, but who ca

Arun Sojan Parolikkal 44 Dec 23, 2022
An application for creating encrypted vaults for the GNOME desktop.

Vaults An application for creating encrypted vaults for the GNOME desktop. It currently uses gocryptfs and CryFS for encryption. Please always keep a

Martin Pobaschnig 51 Dec 17, 2022
age-encrypted secrets for NixOS; drop-in replacement for agenix

ragenix ragenix provides age-encrypted secrets for NixOS systems which live in the Nix store and are decrypted on system activation. Using ragenix to

YAXI 91 Jan 8, 2023
Trustworthy encrypted command line authenticator app compatible with multiple backups.

cotp - command line totp authenticator I believe that security is of paramount importance, especially in this digital world. I created cotp because I

Reply 71 Dec 30, 2022
An open source desktop wallet for nano and banano with end-to-end encrypted, on chain messaging using the dagchat protocol.

An open source wallet with end-to-end encrypted, on chain messaging for nano and banano using the dagchat protocol.

derfarctor 22 Nov 6, 2022