Encryption Layer in Storage Stack - Terms

Terms

The terms listed in the beginning of the article refer to such an encryption layer in different positions. Unfortunately, the naming conventions are different for different speakers. In general, every method in which data is transparently encrypted on write and decrypted on read can be called on-the-fly encryption (OTFE), although some prefer to use this name only to encryption of a sector-addressable layer. Full Disk Encryption (FDE) or whole disk encryption is used by some to refer to encryption a sector-addressable layer (a physical disk and not a logical disk), whereas others use it to denote only to encryption of physical disk and not a logical disk. Filesystem-level encryption or cryptographic filesystem is used to refer to a filesystem that can selectively encrypt files stored in it, whereas others distinguish these terms: they use the former to denote a general purpose filesystem that supports encryption while they use the latter to denote a filesystem that is specifically designed to provide encryption and uses some other filesystem to store the files.

Since in many cases people (mistakenly) assume that their collocutor assigns the same meaning to these terms, there are a lot of arguments whether some particular implementation provides some particular feature. For example, the one who contrasts “full disk encryption” with “filesystem-level encryption,” may say that some software package provides FDE, whereas his opponent who contrasts “FDE” with “logical disk encryption” (or “disk partition encryption”) will say that the package does not provide FDE. This article explains that before getting into any such argument it is very important to understand what meaning each speaker assigns to the terms.