{
  "slug": "fscrypt-key-identifier",
  "term": "fscrypt v2 key identifier",
  "aliases": [
    "fscrypt master-key identifier"
  ],
  "definition": "An fscrypt v2 key identifier is a public 16-byte value derived from a master key to identify it in encryption policies and key-management calls.",
  "note": "Linux v6.12 derives the identifier with HKDF-SHA512 in a dedicated context and returns it when adding the key. It is stored openly, not as secret key material. [keyring-code] [hkdf-code] [fscrypt-source]\n\nThe identifier selects the master key, not the complete policy. Modes, flags and data-unit size are separate fields. Matching identifiers do not authenticate a file's contents or establish that its data is current. [uapi] [fscrypt-source]",
  "status": "shipping",
  "advantages": [],
  "limitations": [],
  "supersedes": [],
  "supersededBy": [],
  "firstSeen": null,
  "lastSeen": null,
  "updated": "2026-10-22",
  "related": [
    "fscrypt",
    "fscrypt-policy",
    "authenticated-encryption"
  ],
  "citations": [
    {
      "id": "fscrypt-source",
      "title": "Linux v6.12: fscrypt policy setup, enforcement and key identifiers",
      "url": "https://docs.kernel.org/6.12/filesystems/fscrypt.html",
      "accessed": "2026-10-22"
    },
    {
      "id": "keyring-code",
      "title": "Linux v6.12: master-key identifier derivation",
      "url": "https://github.com/torvalds/linux/blob/v6.12/fs/crypto/keyring.c",
      "accessed": "2026-10-22"
    },
    {
      "id": "hkdf-code",
      "title": "Linux v6.12: HKDF-SHA512 and purpose-specific derivation context",
      "url": "https://github.com/torvalds/linux/blob/v6.12/fs/crypto/hkdf.c",
      "accessed": "2026-10-22"
    },
    {
      "id": "uapi",
      "title": "Linux v6.12: fscrypt policy structures and identifier size",
      "url": "https://github.com/torvalds/linux/blob/v6.12/include/uapi/linux/fscrypt.h",
      "accessed": "2026-10-22"
    },
    {
      "id": "hesela-fscrypt",
      "title": "Hesela: filesystem encryption and the execution backend",
      "url": "https://hesela.com/analyses/checksums-identity-and-lost-writes/#filesystem-encryption",
      "accessed": "2026-10-22"
    }
  ]
}