0

I want to build a shell script which will use TrueCrypt to create a temporary, one-time use container with a random key file to be used for scratch space. Basically I want the equivilent of a Linux tmpfs mount (with encrypted swap), but for Mac OS X.

How can I generate a TrueCrypt volume with a random key file under Mac OS X?

3
  • How do you plan to generate the random key? creating a TrueCrypt container is easy enough but when you mention "random" key that indicates an unecrypted text file that contains your key which does not seem like a good idea.
    – Ramhound
    Sep 12, 2013 at 18:00
  • dd if=/dev/urandom of=temp_keyfile bs=1 count=2048 would work.
    – Josh
    Sep 12, 2013 at 18:01
  • @Ramhound see my answer for what I was trying to accomplish
    – Josh
    Sep 12, 2013 at 22:32

1 Answer 1

0

The following commands will create a TrueCrypt volume with a random key file on the device $DEVPATH, * completely overwriting any information on that disk/device!!!* It will then attach the TrueCrypt container, create an HFS+ format volume on this device, and destroy the key it used to create it:

#!/bin/bash

# Source for random data. Use /dev/random for more secure but slower random data""
RAND=/dev/urandom

# Create a random keyfile:
KEYFILE=/tmp/scratch.key
dd if=$RAND of=$KEYFILE bs=1 count=4096

# Create a TrueCrypt volume on $DEVPATH using $KEYFIlE as the keyfile:
/Applications/TrueCrypt.app/Contents/MacOS/TrueCrypt -t -c \
  -k $KEYFILE --volume-type=normal --quick --encryption=AES \
  --hash=RIPEMD-160 --filesystem="none" --password="" \
  --random-source=$RAND $DEVPATH

# Attach the TrueCrypt volume as a device:
/Applications/TrueCrypt.app/Contents/MacOS/TrueCrypt -t --mount \
    -k $KEYFILE --password="" --protect-hidden=no \
    --filesystem=none $DEVPATH

# Find the TrueCrypt device:
TCDEV=$(/Applications/TrueCrypt.app/Contents/MacOS/TrueCrypt -t -l | grep $DEVPATH | cut -d ' ' -f 3)

# Create a filesystem on the TrueCrypt device:
diskutil eraseVolume JHFS+ Scratch $TCDEV

# And destroy the key so this is a one-time use volume:
srm $KEYFILE

Note that:

  • The TrueCrypt volume that is created uses a random key file with no password. The random key file is created by dd if=$RAND of=$KEYFILE bs=1 count=4096. Remove that line and point KEYFILE= at a static file if you want a reusable container. BE SURE TO ALSO REMOVE THE LINE: srm $KEYFILE if you do, because that file line SECURELY ERASES THE KEY FILE!!!*
  • The random data for this script comes from the non-blocking random source /dev/urandom. Change to RAND=/dev/random for more security but slowdowns.
  • The device $DEVPATH WILL BE OVERWRITTEN BY THIS COMMAND!!!! Be absolutely sure you know what you're doing. To be safe, set DEVPATH to a file, like /tmp/some_file and append a --size=nnnn to the TrueCrypt line which creates the volume, where nnnn is the byte size of the file to create. Remove the --quick option. This will be much slower.
  • This works on Mac OS X. For Linux, use mkfs.ext3 rather than diskutil eraseVolume. Or just use mount -t tmpfs and encrypted swap ;-)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .