Suppose you have 2 drives you want to encrypt using different encryption algorithms, as an example: AES256 and Twofish.
I am aware that using the same password for both could potentially weaken either one or both because it would build a relationship.
But AFAIK it's only true if both passwords are hashed into the same bit string.
If this assumption of mine is correct what if:
- Different hash algorithms are used? (could introduce another weakness?)
- One of the passwords has a 1 appended to the end changing the hash.
Could be I got it completely or mostly wrong, in which case what should I do if I want to encrypt 2+ drives using different software using AES256/AES128. I threw in the Twofish to contrast this problem. I'm not sure if the AES implementation for all the different software is identical, XTC vs. CTS for example.
The goal is to have multiple encrypted partitions/drives across multiple devices utilizing multiple software (dm-crypt, truecrypt for example - assume implementation can vary, but not vulnerable implementation) but having the same password or at least nearly identical one.
If it's not possible then by how much am I weakening myself?
And what if I encrypt the same drive using both Twofish and AES and using the same password (Truecrypt, I think it uses different salts)? The idea is even assuming AES can be broken somehow in reasonable time through some breakthrough in math or w/e there will be nothing to match to verify a good break other than Twofish ciphertext, or even if Truecrypt isn't so obliging since different salts are used they would still need to brute force the hash to get the actual password string?
So the bottom line, why do people keep saying using the same password is insecure? Do they actually mean the bit string cipher key? Since salts transform the same password into completely different bit keys...