Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm trying to find a secure and convenient way to encrypt my external disk with TrueCrypt. Currently I use a 50 character strong password but I'm tired of typing it every single time. I have a Yubikey and several USB sticks that I can dedicate for this task so I think I can harness two-factor authentication. I listed a couple of solutions and the best one I could come up with is below. Before doing anything I decided to get some expert opinion.

The ideea is using Yubikey with a static strong password. This will be something I have. Also I'm planning to use keyfiles stored in a USB memory stick. The USB will not be encrypted but there will be hundreds of small files. And I will be using a small combination of them. So this will also be something I have but the combination will be something I know. So even if someone manages to get hold of both items they won't be able to mount without the combination. Say if I have 100 files on disk and I use 3 files, there will be 161700 combinations.

From a convenience point of view, I'll have to plugin both devices. Touch the Yubikey once and select the keyfiles. It still doesn't sound very fast and easy but I'm hoping it'll be less painful than typing the password manually.

What do you think about this method? What would you propose to make this approach more secure or more convenient (without making it less secure) ?

Thanks in advance.

share|improve this question
1  
"What do you think" questions aren't really a great fit for this site. Can you come up with something more specific? –  tylerl Sep 23 '12 at 7:43
    
I guess you're right as nobody bothered to answer it. I thought I provided enough detail about the method I was planning. So I was wondering if anybody saw any flaws in this but I'll think about it myself. –  Volkan Sep 24 '12 at 12:16
    
wont the file timestamps give away which files you're using? –  anonymous Oct 15 '13 at 15:55
add comment

2 Answers

up vote 4 down vote accepted

It's 161,700 combinations if the order of the files doesn't matter. If the order of the files does matter it's 970,200 combinations. But even 970,200 combination isn't enough against a committed adversary.

Let's say I have your Yubikey and USB stick but don't know the combination and want to brute force the combination. The TrueCrpyt encryption key derivation function runs SHA-512 on the password a thousand times so for 970,200 combination I would need to run SHA-512 ~1 billion times which would take ~10 seconds to do on a current generation GPU. Not very hard.

If you could increase the number of files to 10000 and use 5 files then (assuming the order of the files matters) you'll have almost 10^20 combinations which is probably good enough for this purpose, at least for the next few years until Moore's law catches up with you.

Even that might not be good enough if your adversary is the NSA, GCHQ or the like. So you may want to go with 100,000 files and use 6 of them for a grand total of almost 10^30 combinations which is equivalent to a 100 bit key and probably has more entropy than your current 50 character password.

Having said that it's not clear to me what you gain by re-inventing the wheel instead of using some off-the-shelf two factor authentication (or even three-factor authentication).

share|improve this answer
    
For TrueCrypt order doesn't matter and you're right: 161K is not large enough. AFAIK, NSA or such orgs don't care about me so I don't need huge combination spaces but good to know I can exponantially increase it with a little extra effort. The reason I'm trying to implement such a solution is simply because I don't have a smartcard to use with TrueCrypt. I've started looking into those as well. Thank you for your response. –  Volkan Sep 24 '12 at 23:17
add comment

I suggest combining the the long, static Yubikey password with a short (in comparison) password that you know. Add a file from an USB-stick to the mix. That way you require two items you have (Yubikey and USB-stick) with something you know (the password).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.