2
$\begingroup$

I'm new here and have a basic question about encryption. I plan to securely store sensitive data on a company computer. Being one of hundreds little branches of a bigger company, it is not possible to turn off the computer after business hours (back ups, updates, data exchange).

I started storing documents in Veracrypt containers. I create a new one for each month and as I don't know how much data will end up there, I always use the same container size that fits them all in. Of course I also use the same password for each container. The password itself is secure.

Now after reading a bit more into encryption, let us assume: Someone gets access to the computer and finds multiple containers that all have the same size and password (which the person doesn't know), can the person compare them and resolve the encryption or password?

In other words: Does using the same container size and password for multiple files create a vector of attack to resolve the content of the data?

I hope you got what I mean, English isn't my first language.

Thanks in advance.

$\endgroup$
3
  • 3
    $\begingroup$ No, but it will mean if someone correctly guesses your password, they will have access to all of your containers, which wouldn't necessarily be the case if different passwords were used. Make sure what you're doing isn't shadow IT/going to get you in trouble. There should be policies and existing security controls for this sort of thing. $\endgroup$ Dec 14, 2023 at 17:10
  • $\begingroup$ @samuel-lucas6 Thank you. The whole content of the containers are business related documents, sorted by month. In my country, those have to be stored for an eternity and I thought storing them as a backup on the office pc would make sense. If using the same size/password doesn't put a security hole in it, I'm sure no one would bother trying to break the password. It just needs to serve the purpose to keep an average theft away from accessing it. Of course, there are security measures (cameras & alarm) that protect the building. But I also know how long it takes for police to arrive $\endgroup$
    – Tim_76
    Dec 14, 2023 at 17:26
  • $\begingroup$ "I thought storing them as a backup on the office pc would make sense" No, storing a backup on the same PC will only protect you against drive failures and human error (destroying old files etc., possibly file system errors) - assuming that you are storing the backups in a separate location. You should ask your IT dept on backup solutions. Make sure they test their archives regularly, because the proof is in the restoration of the pudding. $\endgroup$
    – Maarten Bodewes
    Dec 14, 2023 at 18:40

2 Answers 2

2
$\begingroup$

I don't know and can't think of any specific risk associated to using the same container size for several VeraCrypt volumes. It's not making the containers use the same master encryption key, even if the password is shared: that key is random and (with overwhelming certainty) unique per container. If it was not, that would likely have been caught by this competent 2020 audit, which I summarize as: VeraCrypt is nearly as secure as a collaboratively written software of this large size and old roots can be.

On password reuse, a digest of textbooks on security, or the need to be unobjectionable in a Big Company's IT policy, leads to this answer, which is that password reuse is baaad. Which is very true for passwords to websites.

But the risk of password reuse in encryption must be balanced against other risks:

  • If we use multiple passwords, and forget one, the corresponding data is lost. This risk is unique to encryption; it does not apply to most websites. This risk augments very quickly with the number of passwords, in particular because most humans remember passwords only when used often.
  • If in order to avoid the increased risk of the above we write down the multiple passwords, they can get compromised thru that paper backup. While a paper backup is not necessarily bad, that should be in a tamper-evident sealed opaque envelope, thus impossible to use on a regular basis.
  • There's very real risk that the password(s) are compromised thru penetration of the computer's hardware (keyboard itself; it's USB or PS/2 bus if wired, radio link if wireless; it's memory which can be probed thru a PCI device or controller on this bus, or thru the BIOS), and of course a compromise of the OS. At least the last attack can compromise the data without needing the password. When such attack is setup, several passwords give little more protection than one. Thus we must not be overconfident in the security provided by password-based encryption anyway.

So in my opinion, if the secret data is to be accessed by a single person (or group of persons sharing the password and access rights to all the data) on a single computer (or a set of computers with no segregation of some data to a subset of computers), the best option is a single memorized passphrase.

$\endgroup$
-1
$\begingroup$

Yes, using the same container size and password for multiple Veracrypt containers creates a significant vector of attack, even if the password itself is strong. Here's why:

Brute Force Attack: Attackers can perform a brute-force attack against one container and, upon success, use the same password on all other containers of the same size. This significantly reduces the effort and time required to access all your data.

$\endgroup$
3
  • $\begingroup$ The container size is irrelevant to this, and so are all of the other specifics of the question for that matter. If your passwords are brute-forceable then all bets are off. $\endgroup$
    – benrg
    Dec 15, 2023 at 18:50
  • $\begingroup$ my point is that it is become easier if container and password size is same. onece i know the password of one cotainer then it gives me extra information about the password (length). $\endgroup$ Dec 16, 2023 at 4:53
  • $\begingroup$ to benrg, can you help me about this question? crypto.stackexchange.com/questions/109056/… $\endgroup$ Dec 16, 2023 at 4:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.