Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The TrueCrypt website has some detailed information on how to backup (TrueCrypt non-system volumes) securely, summarised below:

  1. Create a new TrueCrypt volume
  2. Mount the main volume.
  3. Copy all files from the mounted main volume directly to the mounted backup volume.

My question is: Why is this necessary? Why not simply copy the encrypted TrueCrypt container file to your backup service/device? According to step 5 of the TrueCrypt tutorial, this container is a normal file that can be copied, moved, etc.

Surely copying this encrypted file to a possibly insecure backup medium is the simplest and most secure way to backup?

What advantages could there be to the method mentioned on the TrueCrypt website? It mentions at the start about files in the volume possibly becoming corrupted - is that relevant? In this case I'm not interested in hidden volumes or plausible deniability.

share|improve this question

4 Answers 4

up vote 11 down vote accepted

Backing up the TrueCrypt container means that you'll end with a time line of your encrypted volume, and all of those versions share the same key. Have different versions of the container with the same key gives the adversary two advantages:

  • Information leakage: The adversary will know which sectors of the volume changed.
  • and, as a consequence, a compromise of the plausible deniability in case you have a hidden volume inside that volume.

In the real world, however, the case is quite different. If you don't have a hidden volume or you don't care about the adversary knowing about your hidden volume, then having some backups of the volume isn't really an issue. The cryptographic concerns (cryptanalysis) are, so far, only theoretical.

share|improve this answer
    
Thanks. It's good to know that TrueCrypt are so thorough with their advice and thinking ahead about potential attacks. I think in this case copying the encrypted file seems reasonable. –  James Bradbury Nov 12 '13 at 11:43

Another way to address this issue would be to copy the container file and encrypt it eg. with openssl before backing it up. For subsequent backups you should use different keys/passwords for backup encryption.

It would be fairly easy to develop a scheme for rule-based key/password generation. Thus, you would rely on a recording passwords. This would make the revovery process much safer.

In my view, this would be easier/more comfortable then the approach the trueCrypt manual outlines.

share|improve this answer

Another considerable advantage is speed. If you have a large TrueCrypt container that is not full, your backup only needs to copy the bytes in use rather than the whole container. Standard tools like rsync or Windows robocopy will only copy files which have been changed, which is typically just a small fraction of your files. If you copy the container, you have to transfer every byte, and you generally have to dismount the drive so you have no access to your files at that time. On my eSATA drive, copying a 25GB container takes 15 minutes, which seems short enough until you start waiting for it.

If you have access separate computer on which to mount the backup container, rsync will transfer the changes securely via ssh, so you could roll your own remote backups.

share|improve this answer
    
How do you account for the time to create the new backup Truecrypt container, when following the "Create a new TC, mount both, copy files" advice? –  Anti-weakpasswords Feb 25 at 1:41
    
Personally I would re-use my containers, but even with a fresh volume every time, it all depends on the link speed and the % of the volume used. Creating a TC on a remote computer with a bus connection to its hard drive is much faster than transferring a complete volume over typical wifi or 100BaseT Ethernet. –  WiringHarness Feb 26 at 3:34

According to TrueCrypt security requirements, there are 2 main concerns regarding volume clones/copies:

  1. Original volume and backups (copies) would use the same key set.
  2. Ability to observe the changes between the backups might aid cryptanalysis if the attacker has access to the backups.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.