Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am changing the password of a truecrypt file container. This takes around 1 minute. Why?

time truecrypt --text --change /tmp/user1.tc --keyfiles= --new-keyfiles= --password=known --new-password=known --random-source=/dev/null"

If I use strace I see that it basically does not do anything: it simply reads lots of random data from /dev/urandom (even if i specified /dev/null as random source) and finally changes the password:

open("/dev/urandom", O_RDONLY)          = 6
read(6, "\36&{\351\212\212\343\202\34\313\242\312I\326\235\245\224\300\354O)\270Q\200 \201J\227\224\311_\212\367"..., 640) = 640
close(6)                                = 0
share|improve this question
up vote 7 down vote accepted

Truecrypt is generating a new key to be associated with the new passphrase. In order to achice the random nature to generate a secure key, truecrypt samples many different sources over a little while(1min). It's necessary for a new secure key. Using /dev/null is not recomended! Hope this clears it up.

share|improve this answer
4  
In fact, using /dev/null as a source for anything will not work, because the null device is only a "sink"; you can't read anything from it. The opposite would be /dev/zero, which is read-only and outputs null bytes... but really, using that as a "random number" source is asking to be shot. – grawity May 31 '10 at 18:26

I successfully used this to create a random source:

         dd if=/dev/urandom of=/root/rn bs=1b count=320

I chose 320 because truecrypt prompts for 320 random chars if you don't specify an random source.

/dev/urandom is somewhat better than /dev/zero

truecrypt --text --change --keyfiles= --new-keyfiles= --password=pw --new-password=newpw --random-source=/root/rn /dev/xvgf1
share|improve this answer
    
This sounds like its asking for trouble using this. I suggest one sticks with the default implementation. – Ramhound Mar 5 '13 at 12:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .