Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to encrypt a file and use 2 factor authentication. What software and hardware do I need?

One approach

  1. a password and
  2. a security token.

Is it possible? Does TrueCrypt support this? Does some security token come with the necessary software?

Another approach may be:

  1. Password
  2. Biometry

But will another finger print reader be able to decode a file that was encoded by a different model of finger print reader? Or will finger print readers come with file encryption software?

share|improve this question
up vote 4 down vote accepted

TrueCrypt allows a form of two-factor authentication, in the form of keyfiles. I won't go into a complete description of the specifics, but in essence you need both the keyfile(s) and the password to open the TrueCrypt volume.

AS a simple form of two factor encryption, you could place the keyfiles on a USB key and use that as a form of security token.

Alternatively, according to the TrueCrypt documentation, TrueCrypt:

TrueCrypt can directly use keyfiles stored on a security token or smart card that complies with the PKCS #11 (2.0 or later) standard [23] and that allows the user to store a file (data object) on the token/card.

This is also quite possibly what you're looking for.

For more information, consult the TrueCrypt documentation on the topic here.

share|improve this answer
I was thinking in another form of security token, the one that has a button and a segmented display, but that will do. – Jader Dias Jun 8 '11 at 21:44
@Jader It is 2-factor authentication (something you know (password) and something you have (file)), as @Kirk points out below. What you're talking about are OTP tokens, which can indeed be used as part of a 2-factor authentication scheme, but are much more complex to use because the absolute necessity to keep the token and the system in perfect synch -- and makes it totally useless if you have any intention of trying to use it in disparate environments that cannot communicate with each other. – Kromey Jun 8 '11 at 21:51

It really depends upon what you mean by a security token. I know that TrueCrypt does support requiring files to be in place, so you could require a file on a USB drive, or even on the hard drive. I don't think that TC actually looks in the file, just simply requires that it be there. Technically that is 2 factor authentication (something you know [passphrase] and something you have [file]).

share|improve this answer
Actually, it does indeed look at the contents of the file -- the data in the keyfile(s), along with your password, are both used to encrypt/decrypt the key that in turn is used to encrypt/decrypt the data. The exact location of the file is irrelevant -- you tell TrueCrypt where it is, and it reads it. – Kromey Jun 8 '11 at 21:48
@Kromey, thanks! I just went to read about it so I could follow up on that. I've never had the opportunity to use a key file other than for testing, and that was ages ago. – Kirk Jun 8 '11 at 21:53
I've never used them myself, due mostly to my perpetual fear of losing the keyfile and thus causing myself to lose all of my encrypted data as well, plus I use passphrases that are more than adequate for the level of protection that I need anyway (which is to say stopping casual snoopers on up to the punk who steals my laptop and thinks he can get my credit card information or steal my identity that way). By the time you're adding keyfiles, you're already not the weakest link in the chain anyway, so the added security is just cosmetic. – Kromey Jun 8 '11 at 21:57
For what it's worth, keyfiles can be superfun, because they can be any file - TrueCrypt doesn't touch the data. As a result, you can, for instance, use a picture of your favourite pet. Or an important email. Or an uncompressed DVD rip, if you're a particular sadist. No trace, no data change. – Lukasa Jun 9 '11 at 21:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .