Is using the same password for multiple TrueCrypted volumes safe?

Question

I want to use TrueCrypt for encrypting multiple disk volumes.

Assume I use the default cryptographic algoritm (AES) and hash algorithm (RIPEMD-160) and that nobody can get my passwords through alternative means such as keylogging etc.

Is it considered safe to use the same password for multiple volumes? Or will an attacker with access to my encrypted volumes find it easier to crack my password if he knows that the same password is used for all volumes?

Answer 1

Using the same password for multiple volumes gives an attacker more information to crack your encryption, so it is bad practice from a cryptography standpoint. Password and key re-use has historically been used to break encryption schemes in the past.

In your case I'd argue that the difference is moot, as anyone who would actually be able to take advantage of you using the same password for multiple volumes would have to be extremely sophisticated and have access to a whole lot of computing power. Anyone that sophisticated would almost certainly have other means to discover the password rather than attacking you cryptographically, they'd simply hack your computer, plant a camera in your home, etc.

It's still a bad idea to use the same password though as you're probably aware.

Answer 2

There are two ways into which reusing the password can weaken security:

1. If the cryptographic process by which the password is converted into keys is not done properly, reusing the password can give the attacker additional leverage to cryptanalytically recover the password or attack the underlying encryption. Fortunately, TrueCrypt does things correctly in that matter (salts, one-way functions...).

2. A password can be stolen in various ways which are out of control of the software. For instance, a camera concealed in the ceiling, with a direct view on the keyboard. Or a keylogger in the keyboard firmware. This all depends on the environment of the machine which uses TrueCrypt. By reusing the same password in both machines, you make the password as weak as the weaker of the two environment -- and if the password gets stolen, the attacker gains immediate access to both.

So reusing the password is a trade-off between usability (only one password to remember) and damage containment (if one password is stolen, so is the other, since that's the same password). If your TrueCrypt volumes are on physical disks in the same machine, I would say that using the same password is not a problem and will not substantially lower security.

Answer 3

Theoretically, the more data is available for analysis, the easier the cryptanalysis is. Having multiple volumes encrypted with the same key is similar to the attacker having access to the same volume at different times when the contents are different.

The crypto and implementation of TrueCrypt has received much attention and it looks like the TrueCrypt team does a good job of protecting against such attacks.