When the encrypted file container contains 100000 files and 500 GB of data, all of them must be decrypted/encrypted when the container is mounted/dismounted.

How can Truecrypt/Veracrypt perform this within a few seconds?

  • 6
    $\begingroup$ It doesn't. It encrypts / decrypts each byte as you access it (or rather the filesystem sector) on the fly. Mounting is just deriving a master key from a user password and unmounting is just deleting that key (along with some OS interactions to setup the virtual drive) $\endgroup$ – SEJPM Oct 23 '20 at 15:20
  • 1
    $\begingroup$ The actual decryption of the "100000 files and 500 GB of data" only occurs when and if the files are read. Mounting involves processing of the passphrase to decipher the volume key, and deciphering only very little data, as necessary for the OS to show the volume mounted. $\endgroup$ – fgrieu Oct 23 '20 at 16:26

Think of it this way.

When you plug in a non encrypted external hard drive, does your computer read all of the data? No, it reads the partition table and some of the directory structure/MFT in order to display disk space usage and the root directory. The same thing occurs when an encrypted drive is mounted, whether it is Truecrypt, LUKS, or Bitlocker.

Disk encryption is block based, each block can be encrypted or decrypted independently of other blocks, to enable random access to the encrypted data. Only the data that needs to be read is read in order for the computer to understand what is being mounted, and thus only the blocks that need to be decrypted are decrypted.

Prior to disk access occurring, the mounting process must first determine the key and encryption method using the password or key material provided, this is very quick unless you have a custom iteration count.

Additionally, on many drives, the read/write speed is far slower than the cryptography speed the computer is able to handle, so there is no perceptible loss of performance due to encryption overhead.

  • $\begingroup$ Also, if one decrypts the whole disk before mounting, what happens when the disk is suddenly disconnected? $\endgroup$ – DannyNiu Oct 24 '20 at 3:57
  • $\begingroup$ @DannyNiu I may be wrong, but decrypting and reading an encrypted block is different from decrypting the disk. I don't think it has to be decrypted on the disk in order to be read. $\endgroup$ – mbomb007 Nov 19 '20 at 19:24
  • $\begingroup$ @mbomb007 I'm just trying to make a point that, confidentiality of the data is completely compromised if a fully-decrypted disk is suddenly disconnected. $\endgroup$ – DannyNiu Nov 20 '20 at 2:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.