I'm using Truecrypt and I have multiple volumes on multiple computers. Keeping each of the 20+ character passwords straight is getting complicated, so I want to use keyfiles. Since the password is being combined with 1024 bytes from the keyfile, does it matter if my password is "dog"? Does a keyfile (say, a compressed file with lots of crazy characters) with a short password have the same brute force protection as a complex 20+ character password? I'm assuming no one has access to my keyfiles.
Tell me more
×
IT Security Stack Exchange is a question and answer site for
IT security professionals. It's 100% free, no registration required.
|
|
If you think the keyfiles are secure, then no password is needed, if you can not have the risk of the keyfiles leaking, then you need to password protect them with a strong password. No password or a weak password is practically the same. You can store your keyfiles within another truecrypt volume with a strong password, this way you only need to remember one password and your keyfiles are secure. |
|||||||||||||||
|
|
If no-one has access to your keyfiles, then no-one is getting access to your data. Passwords are used here as an extra layer of "what if the key is leaked" protection. If the keyfile is absolutely secure (speaking theoretically here!) then so is the data. I have a number of volumes secured purely by keyfiles, with no password at all, where the chance of the key leaking is minimal. Note that this may or may not be a reasonable assumption, depending exactly on your situation - I use it for encrypting my backups (each machine has an independent key, stored on the machine, which it uses to mount a TC volume before backing up to it - which needs to be done without manual intervention, which precludes a password). |
|||
|
|
|
tl;dr - use a strong password, and complement this with keyfiles if possible. In terms of cryptography, it is computationally infeasible break into your TrueCrypt volume without having both the password and the keyfiles. Fundamentally, the decryption key is an xor combination of the hash of the password and the hash of the keyfiles. However, this does not mean that you get the same practical security from both types of key material. TrueCrypt's keyfiles are part of a two-factor authentication scheme. The password is something you know, the keyfiles are something you have. In most cases, something you know is much stronger than something you have - people can steal your belongings, but it's much more difficult to steal your knowledge. A combination of the two allows for strong security. As such, relying only on keyfiles for security is probably a bad idea. You're limited to security-through-obscurity techniques, where you try to hide the keyfiles. If you store them on your hard disk, forensic analysis of your disk will usually be able to locate your keyfiles. If you store them on a USB stick or flash card, a thorough search of your house / person will probably result in an attacker finding them. Using a weak password on your main volume, then encrypting your keyfiles with a strong password is pointless - at that point you should just use a strong password on the main volume, and leave the keyfiles unencrypted. |
|||
|
|
