3

If I decided to do a full disk encryption, or simply encrypt the partition of a disk, then put a encrypted file container which contains sensitive files inside it for a little extra peace of mind, how does that effect security?

I ask this because I'm always hearing some people say that layers of encryption effects the overall security of your... whatever. So is any of this true? If so explain HOW please. thank you.

I'm aware of the speed implications of putting so many layers of encryption and don't care. What I do care about is whether or not this method affects my overall security.

1

Say you memorize a random 16 character password. With 16 characters from a set of 95, there are a total of 9516 possible combinations. Using two layers of encryption each with an 8 character password, each of which has 958 combinations, the maximum number of guesses an attacker would need is not the expected 958 × 958 (9516) but 958 + 958 (959), which is much, much lower. Because of this, one long password would give you a security level of 9516, whereas two half-sized passwords would only give you a security level of 959. The attacker would only need to crack one container at a time.

The only time that using multiple layers would be useful is if you want to use different passwords in order to prevent compromise of the disk encryption password from implying compromise of the container. Because computers naturally need to keep the encryption key in memory, a cold boot attack or other physical attacks may be able to retrieve the key if the computer is powered on. By using a separate container that you close whenever you are not using it, you minimize the amount of time the container's password is present in memory without having to sacrifice full disk encryption.

So, what should you do? Use a single password created with the diceware technique. That involves using physical dice to pick out words from a 7776 (65, the number of possible combinations of five 6-sided dice throws) word dictionary and using the space-delimited words as your password. The amount of entropy present in a diceware password is log2(7776n), where n is the number of words. To have more than 100 bits of password entropy, which is often considered the minimum to be secure for the foreseeable future, you will need to have at least 8 random diceware words. Any less than 6 words and you start getting into dangerously weak territory where cracking becomes possible.

  • i actually plan on using more than 25 characters per encryption. - a few random characters mixed in with not so randomness. i want to do this just in case there is a weakness in one of my passwords. because there is no way i can remember a completely random password. so instead i'm trying to decide if having two different passwords will make up in security for not have a completely random one. and i'm aware of the other ways my security can be compromised but for right now, i only care if this method secures my stuff or not. lol thanks 4 the reply – spuke Nov 30 '18 at 2:21
  • @spuke If the 25 characters are not necessarily fully random, then you should definitely use one, long password instead of two shorter ones. From a cryptographic point of view, one layer with double key length is far, far more secure than two layers with single key length. – forest Nov 30 '18 at 2:23
  • what if i use something like: buffy&spike*plays@together #thevampslayer^^boohoo <--- is that easy to crack? – spuke Nov 30 '18 at 2:29
  • @spuke That would not be too hard to crack. It's effectively 6 words delimited by symbols, which any good password cracking utility like Hashcat has a ruleset for. Worse, many of the 6 words are related. I mean, it could be worse, especially if used for something that didn't use PBKDF2 to slow down cracking like VeraCrypt and TrueCrypt do, but it's really not ideal. – forest Nov 30 '18 at 2:33
  • T_T this is not what i wanted to hear. lol. what if i constructed a password out of abbreviated words mixed in with special characters?: buf&spi+xan&an=theslayteam#forever$_%love <--- that has to be better right? lol (i'm not stupid enough to actually use a password i posted on a public website but it will be SOMEWHAT similar. – spuke Nov 30 '18 at 2:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.