26

Cascading cipher gives a sense of security; and one that is technically justified with respect to the possibility that a weakness in one of the cipher would allow recovering the encrypted data. That's Bruce Schneier's argument, and it made sense in an era where DES, the then leading cipher, was a closed design, clearly deliberately weakened by a small key, ...


7

9 lower case letters with standard English alphabet make around 40-bit direct search this is very low password entropy. This is quite achievable even you use high iteration numbers like 200000 iterations for the HMAC-SHA-256. 200000 makes $\approx 2^{18}$ so in total $\approx 2^{58}$ Even public laboratories in the USA, like Oak Ridge Summit, can achieve ...


6

All ciphers offered by TrueCrypt (e.g. AES, Serpent, Twofish) are "impossible to break" to the best of current public knowledge. Which one of them will be successfully attacked first (if at all) is obviously unknown at this time, hence a matter of personal belief. The same applies to hash functions (SHA512, Whirlpool, RIPEMD160) — there are no relevant ...


5

The problem is not to store an IV but to store an authentication tag. I don't know about any other products that solve this problem in a way similar to BitLocker. LUKS uses XTS by default, and TrueCrypt supported LRW and XTS, among other modes. Neither of these two modes provide any diffusion. Information about various modes for disk encryption is available ...


5

Yes, in case of VeraCrypt there is a difference, but it is negligible in practice. First we need to consider how VeraCrypt actually performs the cascading of the encryption algorithms which is (literally) a block-wise chaining. E.g.: $$C=E_{XTS}^{1}(E_{XTS}^{2}(E_{XTS}^{3}(M)))$$ where each $E$ is a block cipher run in XTS mode and all using the same XTS ...


4

Think of it this way. When you plug in a non encrypted external hard drive, does your computer read all of the data? No, it reads the partition table and some of the directory structure/MFT in order to display disk space usage and the root directory. The same thing occurs when an encrypted drive is mounted, whether it is Truecrypt, LUKS, or Bitlocker. Disk ...


3

how much faster can i recover my password (20+ characters) from knowing nothing about it (it's been years since i last used it) using a gpu instead? According to this benchmark, a single Nvidia Tesla V100 (the best GPU commercially available) will hit 94kH/s on that specific mode (search for 6231 on that page) which is about 300x as fast as your CPU and ...


2

The use of RIPEMD-160 is not a cause for concern. It's the relatively small number of PBKDF2 iterations which is problematic. More than a decade ago, the minimum recommended number of iterations was 10,000. Nowadays, you should probably not be using less than 100,000, regardless of the hash function in use. However, even that is not ideal. If possible, you ...


2

They don't issue cryptographer's licenses to pseudonymous carrion fowl, so I can't rightly claim to be a cryptographer, but I can confidently say that if there is any problem here it is far more likely to arise from unrelated mistakes in VeraCrypt's protocol or implementation than in cryptanalysis of AES-XTS. Any distinguisher on AES-XTS implies a nearly-as-...


2

Answering question 1: I see the following flaws in your model: flaw 1: Any currently known data storage device is prone to accrue errors and data degradation no matter what you do. They also have an expected lifetime, with a different failure rate. USB devices have less durability (on average) than hard-drives, for instance. This means that you may lose ...


1

Obviously using such a short password is bad. However, you may possibly benefit from security-by-obscurity here. If the attacker has no knowledge of the password and the data doesn't seem valuable at first you have a pretty good chance of them not trying BF attacks at all.


1

Unlike the ciphers, the hash algorithm is not used directly to protect your data. Its only purpose is to take your ASCII passphrase and mix it up, shrinking or expanding it to the size required by the underlying ciphers. In order to make brute force attacks more infeasible, this process is repeated thousands of times in an algorithm called PBKDF2-HMAC so ...


1

The IV is not stored in other systems. Apart from using XTS (which truecrypt uses), other disk encryption software typically use ESSIV to dynamically create a unique IV for each sector and this is what is used by bitlocker as well.. The initialization vector of the AES-CBC is determined by AES-ECB encrypting the sector offset with the FVEK. The sector offset ...


Only top voted, non community-wiki answers of a minimum length are eligible