Suppose you have 2 drives you want to encrypt using different encryption algorithms, as an example: AES256 and Twofish.

I am aware that using the same password for both could potentially weaken either one or both because it would build a relationship.

But AFAIK it's only true if both passwords are hashed into the same bit string.

If this assumption of mine is correct what if:

  1. Different hash algorithms are used? (could introduce another weakness?)
  2. One of the passwords has a 1 appended to the end changing the hash.

Could be I got it completely or mostly wrong, in which case what should I do if I want to encrypt 2+ drives using different software using AES256/AES128. I threw in the Twofish to contrast this problem. I'm not sure if the AES implementation for all the different software is identical, XTC vs. CTS for example.

The goal is to have multiple encrypted partitions/drives across multiple devices utilizing multiple software (dm-crypt, truecrypt for example - assume implementation can vary, but not vulnerable implementation) but having the same password or at least nearly identical one.

If it's not possible then by how much am I weakening myself?

And what if I encrypt the same drive using both Twofish and AES and using the same password (Truecrypt, I think it uses different salts)? The idea is even assuming AES can be broken somehow in reasonable time through some breakthrough in math or w/e there will be nothing to match to verify a good break other than Twofish ciphertext, or even if Truecrypt isn't so obliging since different salts are used they would still need to brute force the hash to get the actual password string?

So the bottom line, why do people keep saying using the same password is insecure? Do they actually mean the bit string cipher key? Since salts transform the same password into completely different bit keys...


2 Answers 2


If the password is salted and is long enough to begin with, then yes, using the same password should be fine. (Though a bit riskier than using different passwords --- say, if you have one password stolen by e.g. a keylogger)

The reason for the recommendation "don't reuse passwords" is that it's often hard (or sometimes impossible) to know if the underlying software is properly using salts.


This password advice is not necessarily advice regarding a specific technical or algorithm issue. The technical problems stem from using the same key for multiple encryptions, not the same password.

I think the advice is primarily to help people easily avoid the problem of spreading their security blanket too far. The advice is simple enough that people can follow it without having to learn why they're doing it.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.