Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Is it possible to create one keyfile that opens a Truecrypt volume and this keyfile is protected (aes encryption fe) with a password?
The use case is a True crypt volume accessed by multiple individuals. I would like to distribute one master key in the form of a keyfile with high entropy to prevent brute forcing if the volume gets in the hands of a malicious person. This keyfile is distributed on a usb token where it should be encrypted with their personal password.
What you have described will work perfectly fine, and I would suggest using TrueCrypt again for encrypting the keyfile, given that all participants already know how to use it. Simply create a TrueCrypt partition on the USB device, and put the unencrypted keyfile into that partition.
Doing it that way also has the advantage that it is impossible for a user to accidentally leave the keyfile unencrypted. If you were to use file encryption such as openssl to encrypt and decrypt the keyfile, it would be possible for someone to forget to re-encrypt the keyfile once they have finished using it. Using an encrypted partition via TrueCrypt means this is not possible, which is good.
The drawback here is that you have multiple copies of your keyfile spread around the place. Some users might think that plugging in the USB, entering their personal password, and accessing the keyfile every time they want to access the shared TrueCrypt partition is a hassle, and there is nothing to stop them from copying the unencrypted keyfile onto their local disk for the sake of convenience, which breaks the encryption for everyone.
You are also relying on the strength of the weakest personal password, which with a large number of users is likely to be very weak.
You also have the problem of revoking access: it is difficult to remove a person from the 'circle of trust' because everyone knows the same key. You would have to redistribute/replace the TrueCrypt partition under a new master key, and update everyone's keyfiles to match.
LUKS solves a lot of these issues by allowing multiple passwords to unlock the same disk. Provided the permissions are set up correctly, it is impossible for a user to get the master key for a disk, even if that user knows a valid password for that disk. This makes access revocation very easy.
