Reading on the security of Borg backups and both encryption and authentication is used (Encrypt-then-MAC).

My understanding is authentication is used to prevent tampering which is especially important for backups vulnerable to unauthorized access (cloud storage or safety deposit boxes for example).

Reading on the security of VeraCrypt (which uses XTS), I can’t find anything about authentication.

XTS mode is susceptible to data manipulation and tampering, and applications must employ measures to detect modifications of data if manipulation and tampering is a concern: "...since there are no authentication tags then any ciphertext (original or modified by attacker) will be decrypted as some plaintext and there is no built-in mechanism to detect alterations. The best that can be done is to ensure that any alteration of the ciphertext will completely randomize the plaintext, and rely on the application that uses this transform to include sufficient redundancy in its plaintext to detect and discard such random plaintexts."

Can VeraCrypt encrypted volume be tampered with?

1 Answer 1


Yes it can.

This is very easy to verify for yourself:

  1. Create a small veracrypt container of 300 KBytes.
  2. Place a known file or files in the container.
  3. Close the container.
  4. Using a hex editor, edit a few bytes of the closed encrypted container (avoiding the header section).
  5. Open the edited container with Veracrypt.

Depending upon the luck of the draw, you may see absolutely nothing upon opening the edited container, or you may see something bizarre. In either case, Veracrypt likely did not complain.

  • Curious, if VeraCrypt (and FileVault) among other mainstream encryption tools use XTS which is susceptible to tampering, how is the encrypted data protected against evil maid attacks (if at all)?
    – sunknudsen
    Commented Sep 6, 2020 at 11:16
  • 1
    @sunknudsen - Being able to change encrypted data does not mean it can be changed to anything specific. For all practical purposes you are inserting random data. You could generate a hash upon closure to detect changes but that would become time consuming for very large containers. Commented Sep 6, 2020 at 16:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .