fscrypt-key-identifier · shipping · also fscrypt master-key identifier

fscrypt v2 key identifier

An fscrypt v2 key identifier is a public 16-byte value derived from a master key to identify it in encryption policies and key-management calls.

Related Observatory article: fscrypt v2 key identifier on hesela.com

Linux v6.12 derives the identifier with HKDF-SHA512 in a dedicated context and returns it when adding the key. It is stored openly, not as secret key material. [2] [3] [1]

The identifier selects the master key, not the complete policy. Modes, flags and data-unit size are separate fields. Matching identifiers do not authenticate a file's contents or establish that its data is current. [4] [1]

Relations

related
fscrypt, fscrypt encryption policy, Authenticated encryption

Citations

  1. Linux v6.12: fscrypt policy setup, enforcement and key identifiers (accessed 2026-10-22)
  2. Linux v6.12: master-key identifier derivation (accessed 2026-10-22)
  3. Linux v6.12: HKDF-SHA512 and purpose-specific derivation context (accessed 2026-10-22)
  4. Linux v6.12: fscrypt policy structures and identifier size (accessed 2026-10-22)

Further reading

  1. Hesela: filesystem encryption and the execution backend (accessed 2026-10-22)

JSON: /data/terms/fscrypt-key-identifier.json

Published by Hesela team · Updated

Report a correction · Editorial standards · Reuse guidance

Cite this page
Hesela team. fscrypt v2 key identifier. Hesela. 2026-10-22. https://hesela.dev/terms/fscrypt-key-identifier/