13
$\begingroup$

From what I understand:

  1. TrueCrypt takes the password as message
  2. Add salt
  3. calculates a digest
  4. use digest for encryption

From what I understand. A good hash function

  1. has Second pre-image resistance .i.e. It is difficult to find $m_2$ such that $m_1\neq m_2$ and $hash(m_1) = hash(m_2)$ .i.e. it is difficult to find a salt to produce the same digest

I observe that truecrypt can change my password in seconds (I assume the data is not reencrypted). How is this done while keeping the data on hard drive encrypted?

$\endgroup$
  • 2
    $\begingroup$ it generates a volume key and encrypts that with the password? $\endgroup$ – Richie Frame Aug 5 '14 at 0:36
  • 4
    $\begingroup$ I am not sure if that it how it works, but Truecrypt creates a volume key separate from the password. I assume it then encrypts the key using the password and stores it with the volume, so it can be decrypted then encrypted with a new password $\endgroup$ – Richie Frame Aug 5 '14 at 0:49
  • $\begingroup$ For some background information, the actual encryption key is the one you see when it asks you to move around your mouse when you are setting up encryption. That key is encrypted with your password, as has been stated. $\endgroup$ – md_1976 Aug 8 '14 at 13:55
18
$\begingroup$

What Richie Frame describes above is correct. This is how most FDE solutions work.

A new random encryption key is created whenever new container is created or disk is encrypted. That encryption key (often called Master Key) is then protected by users' password. In case of Truecrypt, master key is stored in volume header (link) and volume header is encrypted with a key derived from a user password (another link).

Such scheme provides (at least) two major benefits:

  • Password changes are quick and do not require re-encryption
  • Multi-user setup is straightforward: just store master key encrypted with every user's password.

Major disadvantage is that if master key is compromised (e.g. by dumping memory while volume is mounted), adversary can maintain access to the data even if users change their passwords. To mitigate this some FDE solutions provide "re-encrypt" option which will create new key and re-encrypt all data.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.