Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Are there security tradeoffs to be considered in deciding between encrypting an entire flashdrive with TrueCrypt versus storing a file encrypted container? The security goal is to be immune to the problem that wear leveling can store data on unused areas of the flash drive, so that all the encrypted data remains secure if the flash drive is lost.

If the entire device is encrypted, then the flash drive is useless without installing TrueCrypt. If a file container is used, then an unencrypted portion could still be used for other purposes (understanding that wear leveling could leave traces of those files), but does that create any vulnerability for the file encrypted portion?

Note that I understand that neither approach solves the problem of file fragments being left elsewhere in the system, e.g. in a swap file, without encrypting the entire system - that's not my question.

share|improve this question
    
Couldn't you bypass the "installing TrueCrypt" bit by carrying another drive with a portable copy of TrueCrypt, or just adding it to this one? –  Iszi Feb 26 '12 at 5:47
1  
The biggest downside to having the entire drive encrypted is that Windows always asks you to reformat the drive. I've had a drive encrypted for a while but I've been meaning to change it to file based encryption for that single usability reason. I don't want to reformat it by accident one day. –  WalterJ89 Feb 27 '12 at 1:56
add comment

1 Answer

up vote 3 down vote accepted

Truecrypt has an article discussing wear-leveling. It would appear that Truecrypt still provides a secure solution as long as you can be sure that your keys have not been compromised. It makes no statement regarding the differences between file-based containers vs. device-based encryption, and so it is likely there are no security tradeoffs to be had aside from those you've already stated.

Therefore, multiple "versions" of a single sector may be available to an attacker. This may have various security implications. For instance, when you change a volume password/keyfile(s), the volume header is, under normal conditions, overwritten with a re-encrypted version of the header. However, when the volume resides on a device that utilizes a wear-leveling mechanism, TrueCrypt cannot ensure that the older header is really overwritten. If an adversary found the old volume header (which was to be overwritten) on the device, he could use it to mount the volume using an old compromised password (and/or using compromised keyfiles that were necessary to mount the volume before the volume header was re-encrypted). Due to security reasons, we recommend that TrueCrypt volumes are not created/stored on devices (or in file systems) that utilize a wear-leveling mechanism (and that TrueCrypt is not used to encrypt any portions of such devices or filesystems).
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.