I am encrypting my computer using Veracrypt. The default 500,000 derivations is quite slow, what would a "safe" balance be between security and speed? My password is more than 20 characters.
$\begingroup$
$\endgroup$
7
-
$\begingroup$ Welcome to Cryptography. AES has 10 rounds for 128 bits key. You are confusing with the key derivation iteration. $\endgroup$– kelalakaCommented Nov 2, 2019 at 20:17
-
$\begingroup$ Ah, thanks. I'm not very good at this. Thanks for informing me! I'll edit the question. $\endgroup$– alex chamberCommented Nov 2, 2019 at 20:23
-
$\begingroup$ could you also add slow=x seconds and the name of the Key Derivation Function that you use? $\endgroup$– kelalakaCommented Nov 2, 2019 at 20:25
-
$\begingroup$ I haven't timed it, and I am actually doing a USB, but it was extremely sluggish. I had set it to 16,000 after but then realised that might not be enough. I will reflash now if you want. It might have been because I did it in an encrypted container not the whole USB, I probably made this question a bit too quickly. I'll reflash now. $\endgroup$– alex chamberCommented Nov 2, 2019 at 20:27
-
1$\begingroup$ Finished. Gonna set to 50k $\endgroup$– alex chamberCommented Nov 2, 2019 at 20:49
|
Show 2 more comments
2 Answers
$\begingroup$
$\endgroup$
VeraCrypt tries each hash and cipher combination with your supplied password if PKCS5-PRF is set to auto-detection on the enter password screen, i.e. it will try all. It will work until one of them work. It can do this in parallel. In the end, if none is working it will inform you that your password is incorrect.
Change it to the PKCS5-PRF that you selected during the setting the volume, it will not test the others. That will decrease the time.
In the attacker's eye, this will slow them, since they have to try all for each candidate passwords during brute-forcing possible passwords.
Also, the 500,000 derivations is important against the password crackers. The higher the better and it will affect the attacker's time linearly. In recent years their capabilities are highly increased.
answered Nov 2, 2019 at 20:44
$\begingroup$
$\endgroup$
You could see each iteration as a try to verify passphrase. In that case you can simply take the 2-log of the number of iterations to see how many bits of security are added. So $\log_2(50000) = 15.6$ bits of security, which can more or less be added to the strength. A million repetition ads about $19.9$ bits of security.
Now a good password phrase with 4 words has around 40 bits of entropy (depending on the scheme and the actual passphrase of course). So the total would be around 60 bits for a million iterations. These are all "somewhere in this ballpark" figures, and password strength is a tricky subject. But if you think of it this way then you can at least make more informed decisions. Some kind of evaluation of strength is paramount.
As you may note, none of the schemes will likely give you anywhere near the (minimum) strength of 112 bits required most of the time for symmetric ciphers. This is why password based key derivation is frowned upon in general. And this is also why anybody that uses triple Veracrypt encryption with a passphrase kept in memory is fooling themselves.
Using a key pair with the private decryption key encrypted with a password is much stronger, especially if access to said private key is limited. It also allows you to encrypt without a passphrase. Of course, the drawback is that you need access to the keys and a computing device, where there may not be one...
answered Dec 4, 2019 at 19:11