A question from a newby:

I have a USB or Standalone HardDrive with a TRUECRYPT hidden partition on it that needs one or more "keyfiles" and a password to access.

What tells the attacker what kind of file or even where to look for those "KEYFILES" on a generic innocent system filled with over 500,000 generic files on multiples drives....??

a) Is hiding a Keyfile or Keyfiles in plain sight a good idea or

b) My other thought was using 7z Format to archive and encrypt that generic KEYFILES which was a .jpg or .pdf or .bmp or .pcx ((after its use with TRUECRYPT)) with its 7z - AES encryption and use of non standard characters to render the now encrypted KEYFILE Useless as KEYFILE if the TRUECRYPT drive was attacked. So the 7z - AES Keyfiles would have to be identified first......and unarchived before the Standalone drive could be attacked....

c)If those fail - Is it necessary to hide those Keyfiles on a separate 2nd smaller USB or on some random server or archive online and therefore 100% physically removed and concealable offsite

Is this thinking logical......or have I overlooked some fatal flaw ......beyond posting on this public board? :-)

Thank you for the good advice re length as passwords and the scary reality of brute force power available at others fingertips.....

Random thought.......Why does not TRUECRYPT not support non standard characters in its password like 7z archiver does? It seems to add a new set of variables...

  • Consider keyfiles as a "something you have" factor, and treat them in a similar way to an RSA token. The point is that you can keep your keyfiles on your person and refuse to reveal the password on the volume, or take advantage of the plausible deniability of TC's hidden volumes.
    – Polynomial
    Apr 29, 2013 at 9:07
  • A non standard character may not always be represented as the same byte on all systems, whereas an "A" is always 0x41. It would suck to have your password work all the time... then suddenly you're no longer able to decrypt it, right?
    – forest
    Apr 8, 2016 at 1:29

2 Answers 2


Loosely-speaking, you can treat the Keyfile as something you have. You can store it on a USB stick for that sole purpose. Whenever you want to decrypt your secret file, you plug that stick and decrypt.

You can add an extra layer of security by making that USB stick a TrueCrypt volume, thus protecting your Keyfile with a password.

Of course, you can hide your Keyfiles in plain sight. There reason I would not recommend that is that I don't think it'd be that difficult for an attacker to eventually figure out which file is your Keyfile.

You see, no matter how randomly you chose that file, in the end you're a human being. Believe it or not, we're very predictable.

Lastly, a relevant warning from TrueCrypt documentations

WARNING: If password caching is enabled, the password cache also contains the processed contents of keyfiles used to successfully mount a volume. Then it is possible to remount the volume even if the keyfile is not available/accessible. To prevent this, click 'Wipe Cache' or disable password caching.


For A, you are simply relying on obscurity which provides some protection, but not as much as a slightly more complex password. Say you have 140,000 files. You only gain as much security as you would by adding another 3 case-sensitive letters to your password.

B or C however seem wise. Even better, combine B and C. Encrypt the key file and store it separately on a smaller drive. Then the attacker needs both something you know (the 7z AES key) and something you have (the other USB drive). This gives you two factor authentication where B or C alone only give you one factor.

  • -1 for the first paragraph. WAT?
    – Adi
    Apr 29, 2013 at 13:29
  • @Adnan - what's the problem? PDFs are a structured format. They can be easily recognized as PDFs unless Trucrypt actually uses a real PDF as a keyfile. (I'm not that familiar with TruCrypt, but I'd expect a key file to look like a key file (ie, random).) Most image, media and document formats have file headers (or some other attribute) that will let you identify the type of file from data alone. Apr 29, 2013 at 13:35
  • @Adnan - never mind, did some reading, I see that my impression of a key file is wrong and that it is actually just a file that you have to posses. Key file is such a bad choice of term on TrueCrypts part. I have altered my answer according to what TrueCrypt means by Keyfile. Apr 29, 2013 at 13:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .