TrueCrypt and Keyfiles hidden among 500,000 other .pdf files

Question

A question from a newby:

I have a USB or Standalone HardDrive with a TRUECRYPT hidden partition on it that needs one or more "keyfiles" and a password to access.

What tells the attacker what kind of file or even where to look for those "KEYFILES" on a generic innocent system filled with over 500,000 generic files on multiples drives....??

a) Is hiding a Keyfile or Keyfiles in plain sight a good idea or

b) My other thought was using 7z Format to archive and encrypt that generic KEYFILES which was a .jpg or .pdf or .bmp or .pcx ((after its use with TRUECRYPT)) with its 7z - AES encryption and use of non standard characters to render the now encrypted KEYFILE Useless as KEYFILE if the TRUECRYPT drive was attacked. So the 7z - AES Keyfiles would have to be identified first......and unarchived before the Standalone drive could be attacked....

c)If those fail - Is it necessary to hide those Keyfiles on a separate 2nd smaller USB or on some random server or archive online and therefore 100% physically removed and concealable offsite

Is this thinking logical......or have I overlooked some fatal flaw ......beyond posting on this public board? :-)

Thank you for the good advice re length as passwords and the scary reality of brute force power available at others fingertips.....

Random thought.......Why does not TRUECRYPT not support non standard characters in its password like 7z archiver does? It seems to add a new set of variables...

Answer 1

Loosely-speaking, you can treat the Keyfile as something you have. You can store it on a USB stick for that sole purpose. Whenever you want to decrypt your secret file, you plug that stick and decrypt.

You can add an extra layer of security by making that USB stick a TrueCrypt volume, thus protecting your Keyfile with a password.

Of course, you can hide your Keyfiles in plain sight. There reason I would not recommend that is that I don't think it'd be that difficult for an attacker to eventually figure out which file is your Keyfile.

You see, no matter how randomly you chose that file, in the end you're a human being. Believe it or not, we're very predictable.

Lastly, a relevant warning from TrueCrypt documentations

WARNING: If password caching is enabled, the password cache also contains the processed contents of keyfiles used to successfully mount a volume. Then it is possible to remount the volume even if the keyfile is not available/accessible. To prevent this, click 'Wipe Cache' or disable password caching.

Answer 2

For A, you are simply relying on obscurity which provides some protection, but not as much as a slightly more complex password. Say you have 140,000 files. You only gain as much security as you would by adding another 3 case-sensitive letters to your password.

B or C however seem wise. Even better, combine B and C. Encrypt the key file and store it separately on a smaller drive. Then the attacker needs both something you know (the 7z AES key) and something you have (the other USB drive). This gives you two factor authentication where B or C alone only give you one factor.