Keyfile worries

Question

I would like to use key-files for KeePass and/or TrueCrypt; however I have some worries here.

1. How does keyfile decryption work? Does it work by running a file through and getting a hash? Or does the software actually read the contents of the keyfile and use the contents of that file as the decryption password?
2. Either method seems risky to me... If you're using hashing method you must ensure that the file is never changed; and if you are reading the contents of the file you must ensure that the contents never change and that the contents don't get an erroneous data added.

Basically how do keyfiles work?

Answer 1

You can probably think of keyfiles as files containing a ridiculously long, unreadable password.

In this way, that keyfile cannot change once you've set it. Just like I register with gmail.com using the password 'foo123' and then log in with 'foO123'.

When you say 'contents' in 2. I think you may have the wrong idea. Its the entire file that's used (almost, see below) including any wrappers or metadata or whatever you call it. Its used.

---

Here's the documentation on keyfiles from truecrypt. Note other implementations of 'keyfiles' will differ.

The relevant bit is as follows:

Keyfiles

TrueCrypt keyfile is a file whose content is combined with a password. The user can use any kind of file as a TrueCrypt keyfile. The user can also generate a keyfile using the built-in keyfile generator, which utilizes the TrueCrypt RNG to generate a file with random content (for more information, see the section Random Number Generator).

The maximum size of a keyfile is not limited; however, only its first 1,048,576 bytes (1 MB) are processed (all remaining bytes are ignored due to performance issues connected with processing extremely large files). The user can supply one or more keyfiles (the number of keyfiles is not limited).

Keyfiles can be stored on PKCS-11-compliant [23] security tokens and smart cards protected by multiple PIN codes (which can be entered either using a hardware PIN pad or via the TrueCrypt GUI).

So yes, you could use a picture/photo, an openoffice document or a mp3 file. It doesn't matter what it is or how horrendously big it is, just the first 1MB will be used as your 'password'. Just don't let it get changed because if it is and you have no backup, your data is unrecoverable.

Answer 2

My understanding is that the file itself, represented as a byte[], is used as the key. I personally use pictures as key files, which seems to work well. You are correct in your assumption that if the contents of the file changes your key file will be invalidated.

Answer 3

For both KeePass and TrueCrypt, all your input (passwords, key files, etc) is crammed into a single, fixed-length key (length depends on the encryption algorithm). The methods used to do that vary, but hashes are involved.