1. A method for securing a plaintext file F p in a file system having storage resources accessible to an authenticable user U with an untrusted client device, said method comprising: a) distributing said plaintext file F p to at least one block M i belonging to said storage resources; b) assigning to each of said at least one block M i a corresponding symmetric per-block key KB i ; c) encrypting said at least one block M i containing said plaintext file F p with said corresponding symmetric per-block key KB i to obtain corresponding at least one encrypted block C i containing a ciphertext file F c corresponding to said plaintext file F p ; d) assigning to said authenticable user U a user key KU; e) encrypting each said corresponding per-block key KB i with said user key KU to generate a wrapped key to said at least one encrypted block C i ; and f) placing said wrapped key in a header of said at least one encrypted block C i ; whereby said wrapped key introduces a level of indirection to said ciphertext file F c .