Are backups of truecrypt volumes with different pass phrases a security risk?

Question

Lets say that I periodically change the pass-phrase on a truecrypt volume. The volume is regularly backed up, so my backup system has many copies of that volume, many of which have a different volume header due to having different pass phrases.

If an attacker gains access to my backup system, does having access to many copies of the volume header (for different pass-phrases) make it significantly easier for them to break the encryption on the volume?

Obviously I realise that you only need to guess one pass-phrase for all of the backups to be accessible (since you can back up the volume header from the volume who's pass-phrase you know and restore it onto any of the others) but does having multiple copies of the header make it easier than infinitesimally reducing the exhaustive search space required?

Answer 1

The TrueCrypt authors explicitly recommend not doing this. When you copy a container, all copies share the same master-key. While this doesn't allow an attacker to break the encryption itself, it leaks some information.

If you follow the above steps, you will help prevent adversaries from finding out:
Which sectors of the volumes are changing (because you always follow step 1). This is particularly important, for example, if you store the backup volume on a device kept in a bank's safe deposit box (or in any other location that an adversary can repeatedly access) and the volume contains a hidden volume (for more information, see the subsection Security Requirements and Precautions Pertaining to Hidden Volumes in the chapter Plausible Deniability).

From http://www.truecrypt.org/docs/?s=how-to-back-up-securely

And of course you can forget about plausible deniability if you use multiple containers with the same master key.

---

The recommended way of backing up a truecrypt volume is creating a new volume (with a new master key) and copying the files.

Answer 2

I don't seem to be able to make a comment, but in reference to the (generally great) answer by BlueRaja, it's the security of passphrases that can be the weakest link here, not the encryption key.

Typically passphrases have weaker entropy than keys, so the search space might be much smaller than 128 (or 96) bit. The effective search-space is that of the weakest passphrase.

The answer in principle is still correct. If the security of (all) the passphrases is still good - i.e. all with high entropy, unpredictable values, then the search-space is only reduced by the amount of volumes produces. With high entropy, it still shouldn't make a big difference to security.

Answer 3

As far as I can tell this does not constitute any security drop. Common practice as well as a quick Google search that I did, both suggest that Truecrypt volumes are salted. You'd only be able to attack multiple volumes at the same time if they use the same salt, and that is very unlikely.

The use of salts is standard in many cryptographic tasks exactly because of this potential problem.

Answer 4

The only issue would be that the expected time to brute-force the password would be significantly reduced, by a factor equal to the number of volumes they're given. So for example, if they are given 5 volumes, it would take 1/5th the time to brute-force the key, under the (highly dubious) assumption that testing the key on 5 volumes takes just as long as testing it on one.

This is probably not a major concern, however; even if you used "only" a 128-bit key, and the attacker had a million volumes to work with, your effective security would only be reduced by 30-bits, leaving a still-hefty 96-bits of security.

So, as long as you don't choose to encrypt with an algorithm that has a serious plaintext vulnerability (none of the algorithms used by TrueCrypt currently do), you should be fine.