2

Can you prove, for the most common disk encryption programs like Veracrypt or LUKS/dmcrypt, that a second factor like a yubikey or a keyfile on a USB disk is required? If this is not the case is there anything the end user could do? Like some configuration options?

In some countries there are key disclosure laws and in case plausible deniability would be possible you could just claim the dog ate it. They probably still won't believe you, but anyways.

  • 1
    (just my opinion, but "been used" was more clear ... when reading now, I was thinking "of course a second factor is not required to use LUKS etc., what do you want to prove there") – deviantfan Oct 19 '18 at 21:19
  • @deviantfan i hear you, but I was really confused in the other wording. Suggestions? – schroeder Oct 19 '18 at 21:26
  • "has been used" does not imply that it is required, just that someone tried – schroeder Oct 19 '18 at 21:26
  • Well, also true, I hope the second part about the dog makes it more clear on if/how the second factor is/has been used/required ;) – itwasthedog Oct 19 '18 at 21:27
  • Veracryot has a page about the plausable deniability of hidden volumes. veracrypt.fr/en/Plausible%20Deniability.html that may be what you're looking for. – Daisetsu Oct 19 '18 at 21:46
1

It is impossible to tell if a keyfile is required. There is no difference, from an attacker's perspective, between being unable to decrypt a drive because they are exactly one letter off in the password, and because they are missing an entire keyfile. All they know is that they are unable to decrypt it. In fact, if I were to give you a hard drive that has random data on it, you would be unable to tell if I had encrypted it with a password, with a password and a keyfile, or even if it is not encrypted at all and was just wiped.

When you use a keyfile, it is mixed with the password. This is then is used to derive the key that decrypts the header to retrieve the master key. A keyfile can thus be thought of as an extension of your password.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.