Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am changing the password of a truecrypt file container. This takes around 1 minute. Why?

time truecrypt --text --change /tmp/ --keyfiles= --new-keyfiles= --password=known --new-password=known --random-source=/dev/null"

If I use strace I see that it basically does not do anything: it simply reads lots of random data from /dev/urandom (even if i specified /dev/null as random source) and finally changes the password:

open("/dev/urandom", O_RDONLY)          = 6
read(6, "\36&{\351\212\212\343\202\34\313\242\312I\326\235\245\224\300\354O)\270Q\200 \201J\227\224\311_\212\367"..., 640) = 640
close(6)                                = 0
share|improve this question
up vote 7 down vote accepted

Truecrypt is generating a new key to be associated with the new passphrase. In order to achice the random nature to generate a secure key, truecrypt samples many different sources over a little while(1min). It's necessary for a new secure key. Using /dev/null is not recomended! Hope this clears it up.

share|improve this answer
In fact, using /dev/null as a source for anything will not work, because the null device is only a "sink"; you can't read anything from it. The opposite would be /dev/zero, which is read-only and outputs null bytes... but really, using that as a "random number" source is asking to be shot. – grawity May 31 '10 at 18:26

I successfully used this to create a random source:

         dd if=/dev/urandom of=/root/rn bs=1b count=320

I chose 320 because truecrypt prompts for 320 random chars if you don't specify an random source.

/dev/urandom is somewhat better than /dev/zero

truecrypt --text --change --keyfiles= --new-keyfiles= --password=pw --new-password=newpw --random-source=/root/rn /dev/xvgf1
share|improve this answer
This sounds like its asking for trouble using this. I suggest one sticks with the default implementation. – Ramhound Mar 5 '13 at 12:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.