1. A computer-implemented method for securing a plaintext file F p in a file system comprising the steps of: (a) providing storage resources in said file system; (b) providing said storage resources to be accessible to an authenticable user U with an untrusted client device; (c) distributing said plaintext file F p to at least one block M i belonging to said storage resources; (d) assigning to each of said at least one block M i a corresponding symmetric per-block key KB i ; (e) encrypting said at least one block M i of said plaintext file F p with said corresponding symmetric per-block key KB i to obtain corresponding at least one encrypted block C i of a ciphertext file F p corresponding to said plaintext file F p ; (f) assigning to said authenticable user U a user key KU; (g) encrypting each said corresponding per-block key KB i with said user key KU to generate a wrapped key to said at least one encrypted block C i ; and (h) placing said wrapped key in a header of said at least one encrypted block C i ; whereby said plaintext file F p is secured as said ciphertext file F p accessible to said authenticable user U.