There are numerous recommendations for how frequently to change users' passphrases, and I think the most recent NIST recommendation is "no minimum time to change passwords" (I might be mis-quoting). Are the recommendations and logic behind it the same for encrypted drive passphrases?

For instance, LUKS cryptsetup has several bins for individual pass-phrases, each of which can decrypt the master key for the drive. There is plenty of documentation on how to change the passphrase: add a new passphrase to an unused bin, verify that it works, then delete/overwrite the previous passphrase bin. But I cannot find documentation that suggests how often this should be done.

  • 3
    As you state NIST has changed their recommendations for password change in general. How often to change it for your purpose is going to be down to your risk assessment and risk appetite. In other words once you have assessed your asset against possible threat and vulnerabilities then you might be able to draw a conclusion on how often, if at all, you need to change it – ISMSDEV May 2 '18 at 20:43
  • So that suggests that the "password change policy" should be roughly the same for account passwords and encrypted-disk passphrases alike. Thanks, @ISMSDEV. – r2evans May 2 '18 at 20:54
  • 1
    I might be wrong, but I think changing the HDD encryption password is useless, unless you suspect somebody has stolen it or has stolen a copy of your HDD. – reed May 2 '18 at 22:03
  • Great points, thank you @reed! I had thought a little about the remote-access portion, but not about possibly-cloned drives, a key difference between user-accounts and encrypted drives. – r2evans May 2 '18 at 22:06

If there's no reason to suspect the password is known or can reasonably be guessed by somebody else, then there's no reason to change it.

Password is or might be known to somebody else:

  • it has been stolen, or guessed, or bruteforced
  • you notice strange changes in your accounts or suspicious lines in your logs, etc. so somebody might be using your password
  • your machine has been infected, so any password you have typed lately might have been stolen
  • it has been handed out to other people on purpose (for example for getting support, etc.)

Password can reasonably be guessed (weak or weakened password):

  • an attacker has stolen a hash of your password, or they have stolen a file encrypted with your password (they can bruteforce it more easily with dedicated hardware and software)
  • you use a weak password, or even use the default password provided by the service or device
  • you are forced to use a weak password (like a numeric PIN) which could be bruteforced within a reasonably short time, so you need to change it regularly to make it hard for the attacker to gain continuous access
  • you use the same password for two or more different purposes, and that makes it more likely to be stolen or guessed

So for an encrypted HDD, for example, this means you should change the password if you suspect your nosy coworker who is always glancing at your keyboard has seen it or has finally been able to figure it out. Or for example, you should change it if somebody somehow stole a copy of your HDD (it could also be a backup copy), because then the attacker can try to bruteforce it much more easily (with specific software or hardware). If they finally find the password they will be able to read all your data in the stolen HDD copy, but at least they can't come back and use that same password to easily read all your HDD again (because you have changed the password). Yet another example: you should change your HDD password if you are using the same password as your WIFI, and you are giving your WIFI password to all your friends so they can access the internet at your home. Of course those passwords should be different.

  • I like the third example, especially if the e-drive pass, the wifi pass, and my luggage all have the same combo: 1 2 3 4 5. – r2evans May 3 '18 at 0:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.