# How does Truecrypt change password without the need for a complete re-encryption of volume

From what I understand:

1. TrueCrypt takes the password as message
3. calculates a digest
4. use digest for encryption

From what I understand. A good hash function

1. has Second pre-image resistance .i.e. It is difficult to find $m_2$ such that $m_1\neq m_2$ and $hash(m_1) = hash(m_2)$ .i.e. it is difficult to find a salt to produce the same digest

I observe that truecrypt can change my password in seconds (I assume the data is not reencrypted). How is this done while keeping the data on hard drive encrypted?

-
it generates a volume key and encrypts that with the password? –  Richie Frame Aug 5 at 0:36
@RichieFrame I am an absolute n00b. please walk me through –  aiao Aug 5 at 0:38
I am not sure if that it how it works, but Truecrypt creates a volume key separate from the password. I assume it then encrypts the key using the password and stores it with the volume, so it can be decrypted then encrypted with a new password –  Richie Frame Aug 5 at 0:49
@RichieFrame That makes sense. Thank you –  aiao Aug 5 at 0:53

What Richie Frame describes above is correct. This is how most FDE solutions work.

A new random encryption key is created whenever new container is created or disk is encrypted. That encryption key (often called Master Key) is then protected by users' password. In case of Truecrypt, master key is stored in volume header (link) and volume header is encrypted with a key derived from a user password (another link).

Such scheme provides (at least) two major benefits:

• Password changes are quick and do not require re-encryption
• Multi-user setup is straightforward: just store master key encrypted with every user's password.

Major disadvantage is that if master key is compromised (e.g. by dumping memory while volume is mounted), adversary can maintain access to the data even if users change their passwords. To mitigate this some FDE solutions provide "re-encrypt" option which will create new key and re-encrypt all data.

-

I would have made this a comment, but I don't have the reputation points.

For some background information, the actual encryption key is the one you see when it asks you to move around your mouse when you are setting up encryption. That key is encrypted with your password, as has been stated.

-