Microsoft® Windows® 2000 Security Handbook

EFS Concepts

EFS is a public key system. Whenever it gets a request to encrypt a file or directory, EFS uses a randomly generated key, called the File Encryption Key, or FEK, which is protected by the user's private key. The user's public/private key pair is independent and stored separately. The public key is available to any user who requests it. The private key, obviously, belongs only to the user who owns it. The FEK is encrypted using the user's public key but is decrypted with the private user key. In the current release of Windows 2000, EFS uses the Extended Data Encryption Standard (DESX), a variant of Data Encryption Standard (DES), as the encryption algorithm. Future releases will let the administrator add other encryption algorithms. ...