1

Let's assume, an attacker gains access to an encrypted container with a weak password. They start a brute-force attack and I assume they will succeed. To protect any content which has been added to the container after the leak, I decide to change to a stronger password.

However, at this point, it doesn't make sense to just change the password of the container, right? Won't I have to reencrypt everything since the attacker can extract the "master key" of the container which won't change with a password change?

2

This is correct and to some extent applyes even if the container is not leaked yet. If there is any way the attacker may be able to get to the old version of the container (or just its header) for example if you have backups or ssd with wear leveling, it is better to reencrypt.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.