Lets say that I periodically change the pass-phrase on a truecrypt volume. The volume is regularly backed up, so my backup system has many copies of that volume, many of which have a different volume header due to having different pass phrases.

If an attacker gains access to my backup system, does having access to many copies of the volume header (for different pass-phrases) make it significantly easier for them to break the encryption on the volume?

Obviously I realise that you only need to guess one pass-phrase for all of the backups to be accessible (since you can back up the volume header from the volume who's pass-phrase you know and restore it onto any of the others) but does having multiple copies of the header make it easier than infinitesimally reducing the exhaustive search space required?

4 Answers 4


The TrueCrypt authors explicitly recommend not doing this. When you copy a container, all copies share the same master-key. While this doesn't allow an attacker to break the encryption itself, it leaks some information.

If you follow the above steps, you will help prevent adversaries from finding out:
Which sectors of the volumes are changing (because you always follow step 1). This is particularly important, for example, if you store the backup volume on a device kept in a bank's safe deposit box (or in any other location that an adversary can repeatedly access) and the volume contains a hidden volume (for more information, see the subsection Security Requirements and Precautions Pertaining to Hidden Volumes in the chapter Plausible Deniability).

From http://www.truecrypt.org/docs/?s=how-to-back-up-securely

And of course you can forget about plausible deniability if you use multiple containers with the same master key.

The recommended way of backing up a truecrypt volume is creating a new volume (with a new master key) and copying the files.

  • Thanks CodeInChaos, this is useful information, especially the suggestion at the end of the page that each new backup volume should be created with a cascade of cyphers.
    – Mark Booth
    Commented Feb 14, 2012 at 10:52
  • @MarkBooth Personally I think that part isn't very important. The cipher being broken is probably the least of your worries. But on the other hand it doesn't hurt much either, it just burns a bit of extra CPU when creating/restoring a backup. Commented Feb 14, 2012 at 11:21
  • Agreed, by copying the contents of the volume rather than copying the volume itself, you are already taking the hit of decrypting everything and re-encrypting it, so for a (hopefully) write once/never read volume the overhead is probably worth it, compared to having that overhead every time you access any file in a working volume. Also, your working volume can be re-encrypted at any time to make it more secure, it would be much more effort to go back through all of your backups and do the same if a vulnerability is found.
    – Mark Booth
    Commented Feb 14, 2012 at 11:46

The only issue would be that the expected time to brute-force the password would be significantly reduced, by a factor equal to the number of volumes they're given. So for example, if they are given 5 volumes, it would take 1/5th the time to brute-force the key, under the (highly dubious) assumption that testing the key on 5 volumes takes just as long as testing it on one.

This is probably not a major concern, however; even if you used "only" a 128-bit key, and the attacker had a million volumes to work with, your effective security would only be reduced by 30-bits, leaving a still-hefty 96-bits of security.

So, as long as you don't choose to encrypt with an algorithm that has a serious plaintext vulnerability (none of the algorithms used by TrueCrypt currently do), you should be fine.

  • Thanks, it's nice to know that my own assumptions about the amount by which the search space is reduced were correct.
    – Mark Booth
    Commented Jan 25, 2012 at 10:36

I don't seem to be able to make a comment, but in reference to the (generally great) answer by BlueRaja, it's the security of passphrases that can be the weakest link here, not the encryption key.

Typically passphrases have weaker entropy than keys, so the search space might be much smaller than 128 (or 96) bit. The effective search-space is that of the weakest passphrase.

The answer in principle is still correct. If the security of (all) the passphrases is still good - i.e. all with high entropy, unpredictable values, then the search-space is only reduced by the amount of volumes produces. With high entropy, it still shouldn't make a big difference to security.


As far as I can tell this does not constitute any security drop. Common practice as well as a quick Google search that I did, both suggest that Truecrypt volumes are salted. You'd only be able to attack multiple volumes at the same time if they use the same salt, and that is very unlikely.

The use of salts is standard in many cryptographic tasks exactly because of this potential problem.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .