Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

From what I understand:

  1. TrueCrypt takes the password as message
  2. Add salt
  3. calculates a digest
  4. use digest for encryption

From what I understand. A good hash function

  1. has Second pre-image resistance .i.e. It is difficult to find $m_2$ such that $m_1\neq m_2$ and $hash(m_1) = hash(m_2)$ .i.e. it is difficult to find a salt to produce the same digest

I observe that truecrypt can change my password in seconds (I assume the data is not reencrypted). How is this done while keeping the data on hard drive encrypted?

share|improve this question
it generates a volume key and encrypts that with the password? – Richie Frame Aug 5 '14 at 0:36
@RichieFrame I am an absolute n00b. please walk me through – aiao Aug 5 '14 at 0:38
I am not sure if that it how it works, but Truecrypt creates a volume key separate from the password. I assume it then encrypts the key using the password and stores it with the volume, so it can be decrypted then encrypted with a new password – Richie Frame Aug 5 '14 at 0:49
@RichieFrame That makes sense. Thank you – aiao Aug 5 '14 at 0:53
up vote 13 down vote accepted

What Richie Frame describes above is correct. This is how most FDE solutions work.

A new random encryption key is created whenever new container is created or disk is encrypted. That encryption key (often called Master Key) is then protected by users' password. In case of Truecrypt, master key is stored in volume header (link) and volume header is encrypted with a key derived from a user password (another link).

Such scheme provides (at least) two major benefits:

  • Password changes are quick and do not require re-encryption
  • Multi-user setup is straightforward: just store master key encrypted with every user's password.

Major disadvantage is that if master key is compromised (e.g. by dumping memory while volume is mounted), adversary can maintain access to the data even if users change their passwords. To mitigate this some FDE solutions provide "re-encrypt" option which will create new key and re-encrypt all data.

share|improve this answer
Great Explanation. For more “key roles” beyond “Master“ see here: – Frank N Aug 21 '15 at 11:21

I would have made this a comment, but I don't have the reputation points.

For some background information, the actual encryption key is the one you see when it asks you to move around your mouse when you are setting up encryption. That key is encrypted with your password, as has been stated.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.