6

I'm trying to simulate a possible attack scenario for my studies.

I've got a image, which has a encrypted disk, encrypted by TrueCrypt (confirmed). TrueCrypt is installed on the image itself too.

During a RAM analysis of the image, the attacker found a few keys using AESKeyFind. A sample output is;

FOUND POSSIBLE 128-BIT KEY AT BYTE 35b880c 

KEY: b4ce75c857163e668818d0d76c46bad2

EXTENDED KEY: 
b4ce75c857163e668818d0d76c46bad2
ef3ac098b82cfefe30342e295c7294fb
ad18cfd21534312c25001f0579728bfe
e9257464fc114548d9115a4da063d1b3
1a1b1984e60a5ccc3f1b06819f78d732
b6153a5f501f66936f046012f07cb720
86bc8dd3d6a3eb40b9a78b5249db3c72
7f57cde8a9f426a81053adfa59889188
3bd6092392222f8b82718271dbf913f9
b9ab909a2b89bf11a9f83d6072012e99
f39a7edad813c1cb71ebfcab03ead232

CONSTRAINTS ON ROWS:
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000

Assuming that there's no other software using encryption keys, how could a attacker access the TrueCrypt volume? Could he eventually crack the key to gain a plaintext password, or could he use this key as a key file to open the volume?

1
  • According to github.com/makomk/aeskeyfind, the utility is not perfect and cannot detect 256-bit keys that are stored using certain optimizations for decryption. I don't know if TrueCrypt uses said optimizations. – forest Jan 1 '19 at 8:37
4

That is not a TrueCrypt key. You can see that the key itself is 128 bits in length, and the number of round keys is 11, which is consistent with 128-bit AES. TrueCrypt uses 256-bit keys which, for AES, uses 15 round keys and has much larger keys at 256 bits. Whatever that key is for, it did not come from TrueCrypt. Let's assume that you did get the TrueCrypt key from memory, though, and you had on your hand the full 256-bit master key. So, what could be done with it?

Could he eventually crack the key to gain a plaintext password

TrueCrypt and the newer VeraCrypt do not use your password directly as a key. Instead, it is passed through a very slow function called PBKDF2 which converts your ASCII password into a raw, binary key. However, TrueCrypt does not even use this raw key to encrypt the volume. Instead, a single master key (itself generated randomly at the time of volume creation) is encrypted with that key, and this encrypted master key is stored on the disk. When you input your password, it is passed through PBKDF2, and the resulting key is used to decrypt the master key. This master key is what is cached in memory and which is available to an attacker who is able to retrieve memory contents.

While this does mean that an attacker cannot derive your password directly from the cached master key, it does not mean the attacker cannot attack your password in other ways. If he has access to the volume header, he can guess candidate passwords and see which one unlocks the drive. While this can be automated, the slow PBKDF2 function makes this tedious for all but the weakest passwords.

or could he use this key as a key file to open the volume?

Now that he could do. If he has access to this key, then he'll absolutely be able to access the volume and decrypt any data held within it. Of course, because he can't easily reverse the key into your plaintext password, he couldn't re-use your password on other TrueCrypt volumes or anywhere else the password was used, at least not without successfully cracking it.


If you're trying to recover data specifically from disk encryption software, a simple naïve search for encryption keys in memory might not be sufficient. This is because lots of disk encryption software, including TrueCrypt (except for ancient versions), VeraCrypt, and LUKS, uses a special mode of encryption called XTS. This encryption mode actually takes two keys, called a main key and a tweak key. In order to decrypt the disk, you would need to obtain both 256-bit keys. XTS mode works like so:

XTS mode

Both keys are standard 256-bit AES keys, but both are absolutely necessary to decrypt the disk. These two keys are derived from the master key which itself is stored on the disk in an encrypted form as mentioned earlier. The key derived directly from your password is not stored in memory, as it is only used briefly to decrypt the master key, and then discarded.

1
0

Truecrypt uses 256bit keys for header keys. HMAC-SHA-512, HMAC-RIPEMD-160, HMAC-Whirlpool are used for key generation function which is not reversible. You can not get password even if you get the full size key.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.