2

TrueCrypt encrypts and decrypts a disk with a password which is converted into a pseudo-random key with the PBKDF2 function.

Other FDE programs use random keys that are stored on the disk. Where exactly are these random keys stored? They have to be accessible after the computer starts and before the OS is loaded in order to decrypt the disk.

The random keys are encrypted and can be decrypted with the password that the user chose. Why are random keys used for FDE? If someone is able to get the password, the hacker would get the cipher key anyway. There would be no difference between random keys and pseudo-random keys.

4

In full-disk encryption you usually have a key hierarchy. A Key Encryption Key (KEK) is derived from a user password, as you stated often this is done using PBKDF2 (alternatively nowadays more preferred is scrypt). The KEK then is used to encrypt the Disk Encryption Key (DEK) which is actually used to encrypt the storage media.

I am not entirely sure if TrueCrypt really uses the password derived key to encrypt the disk. However, coming to your first question: Where exactly are these random keys stored? Every FDE solution has one tiny part of the disk which is not encrypted and where the DEK is stored in a secure manner (encrypted, see process above). This is the reason why attacks such as the Evil-Maid can work. On boot, the system needs to start a minimal environment which prompts the user for his password, derive the KEK and decrypt the DEK. It then checks whether the DEK is actually correct (probably by decrypting a fixed known pattern). If so, the disk decryption starts and the system continues its boot procedure.

Your next question: Why are random keys used for FDE? Imagine you don't use random keys and instead a fixed-pattern-key that for example is time based. An attacker only has to identify the appropriate setup time and can reduce the amount of keys to brute-force largely!

If someone is able to get the password, the hacker would get the cipher key anyway.

That is true, this is why we need strong passwords, strong cryptographic primitives to derive the keys from them and strong keys that encrypt the disk. The first two are essentially to make brute-forcing the KEK take as long as possible. An attacker will eventually be successful, after all it's a brute-force. However, we want him to not even try because it would take far too long and the information stored on it by then probably outdated and worthless. Alternatively we include penalizing actions, i.e. an increasing timeout on false password entry, or a forced wipe after a specific number of tries.

The key encrypting the media must be random and hard to brute-force, as otherwise an attacker could easily target that key instead of the KEK derivation process that is designed to be slow.

3
  • Thank you for this answer. So this key hierarchy is just used to make brute-forcing slower because there are two decryption processes? In some programs you can store the DEK on a USB to enable Two-Factor-Authentication, which can be another reason for using this key hierarchy. But if you use a strong password, the direct encryption/decryption should be enough, right? – maxeh Oct 14 '15 at 15:04
  • 2
    No, the hierarchy does not make it slower per se. This is just the way it is mostly implemented. Key Hierarchy gives you flexibility, you can change the password without having to re-encrypt the whole disk with a new master key. It gives you security, you can schedule a key change from time to time. Like often policies ask for a key change after X months. There is much more that key hierarchy offers. So you see using only the PW derived key, you loose a lot of essential steps in key management. – Zonk Oct 14 '15 at 15:12
  • Regarding USB as two-factor: The USB drive does not generally store the DEK. The USB drive instead stores a token of some form which is combined with the user's password by the KEK-deriving function. The DEK itself should only be stored on the drive holding the target data, encrypted by the KEK. – Iszi Oct 14 '15 at 19:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.