# Is it safe to use the same password/secret for both VeraCrypt volume and its HMAC?

I am trying to script the integrity check of a VeraCrypt volume.

#! /bin/sh

red=$$'\e[1;31m' end=$$'\e[0m'

set -e

if [ -f "/Volumes/Samsung BAR/bar.hmac" ]; then
printf "\n%s" "Checking integrity..."
if [ "$$(openssl dgst -sha512 -hmac "$$p" "/Volumes/Samsung BAR/bar")" != "$$(<"/Volumes/Samsung BAR/bar.hmac")" ]; then printf "\n%s" "$${red}Check failed${end}" exit 1 fi fi printf "\n%s\n" "Unlocking VeraCrypt volume..." veracrypt --text --non-interactive --mount --pim 0 --keyfiles "" --protect-hidden no --password "$p" "/Volumes/Samsung BAR/bar" /Volumes/Backup

declare -a files=(
"/Users/sunknudsen/.gnupg"
"/Users/sunknudsen/.ssh"
"/Users/sunknudsen/Library/Keychains"
)

for file in "$${files[@]}"; do rsync -axRS --delete "$$file" /Volumes/Backup
done

open /Volumes/Backup

printf "$${red}Inspect backup and press enter$${end}"

veracrypt --text --dismount "/Volumes/Samsung BAR/bar"

echo "Saving HMAC..."

openssl dgst -sha512 -hmac "\$p" "/Volumes/Samsung BAR/bar" > "/Volumes/Samsung BAR/bar.hmac"

echo "Done"


Security warning: Using read -s p is vulnerable to process listing leaks so I need to find another way to feed the password to both openssl and veracrypt.

• Use a PBKDF to drive two keys. And make sure that you are using a good password mechanism like diceware. – kelalaka Sep 8 '20 at 21:26
• Does this answer your question? Using the same secret key for encryption and authentication in a Encrypt-then-MAC scheme – kelalaka Sep 8 '20 at 21:30
• @kelalaka I thought of using key derivation. What would be the benefits of that approach? – sunknudsen Sep 8 '20 at 21:30
• If you are not using a password manager to generate good keys for you, then you can choose a good one password and safely drive both keys. If you are using one then it can handle those for you. – kelalaka Sep 8 '20 at 21:33
• @kelalaka How would you solve the following problem? VeraCrypt encrypted volumes don't support authentication. How can I know the volume has not been tampered with? I am trying to script a solution to that problem. – sunknudsen Sep 8 '20 at 21:35