Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Suppose you have 2 drives you want to encrypt using different encryption algorithms, as an example: AES256 and Twofish.

I am aware that using the same password for both could potentially weaken either one or both because it would build a relationship.

But AFAIK it's only true if both passwords are hashed into the same bit string.

If this assumption of mine is correct what if:

  1. Different hash algorithms are used? (could introduce another weakness?)
  2. One of the passwords has a 1 appended to the end changing the hash.

Could be I got it completely or mostly wrong, in which case what should I do if I want to encrypt 2+ drives using different software using AES256/AES128. I threw in the Twofish to contrast this problem. I'm not sure if the AES implementation for all the different software is identical, XTC vs. CTS for example.

The goal is to have multiple encrypted partitions/drives across multiple devices utilizing multiple software (dm-crypt, truecrypt for example - assume implementation can vary, but not vulnerable implementation) but having the same password or at least nearly identical one.

If it's not possible then by how much am I weakening myself?

And what if I encrypt the same drive using both Twofish and AES and using the same password (Truecrypt, I think it uses different salts)? The idea is even assuming AES can be broken somehow in reasonable time through some breakthrough in math or w/e there will be nothing to match to verify a good break other than Twofish ciphertext, or even if Truecrypt isn't so obliging since different salts are used they would still need to brute force the hash to get the actual password string?

So the bottom line, why do people keep saying using the same password is insecure? Do they actually mean the bit string cipher key? Since salts transform the same password into completely different bit keys...

share|improve this question
add comment

2 Answers

If the password is salted and is long enough to begin with, then yes, using the same password should be fine. (Though a bit riskier than using different passwords --- say, if you have one password stolen by e.g. a keylogger)

The reason for the recommendation "don't reuse passwords" is that it's often hard (or sometimes impossible) to know if the underlying software is properly using salts.

share|improve this answer
add comment

This password advice is not necessarily advice regarding a specific technical or algorithm issue. The technical problems stem from using the same key for multiple encryptions, not the same password.

I think the advice is primarily to help people easily avoid the problem of spreading their security blanket too far. The advice is simple enough that people can follow it without having to learn why they're doing it.

share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.