Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to build a shell script which will use TrueCrypt to create a temporary, one-time use container with a random key file to be used for scratch space. Basically I want the equivilent of a Linux tmpfs mount (with encrypted swap), but for Mac OS X.

How can I generate a TrueCrypt volume with a random key file under Mac OS X?

share|improve this question
How do you plan to generate the random key? creating a TrueCrypt container is easy enough but when you mention "random" key that indicates an unecrypted text file that contains your key which does not seem like a good idea. – Ramhound Sep 12 '13 at 18:00
dd if=/dev/urandom of=temp_keyfile bs=1 count=2048 would work. – Josh Sep 12 '13 at 18:01
@Ramhound see my answer for what I was trying to accomplish – Josh Sep 12 '13 at 22:32

The following commands will create a TrueCrypt volume with a random key file on the device $DEVPATH, * completely overwriting any information on that disk/device!!!* It will then attach the TrueCrypt container, create an HFS+ format volume on this device, and destroy the key it used to create it:


# Source for random data. Use /dev/random for more secure but slower random data""

# Create a random keyfile:
dd if=$RAND of=$KEYFILE bs=1 count=4096

# Create a TrueCrypt volume on $DEVPATH using $KEYFIlE as the keyfile:
/Applications/ -t -c \
  -k $KEYFILE --volume-type=normal --quick --encryption=AES \
  --hash=RIPEMD-160 --filesystem="none" --password="" \
  --random-source=$RAND $DEVPATH

# Attach the TrueCrypt volume as a device:
/Applications/ -t --mount \
    -k $KEYFILE --password="" --protect-hidden=no \
    --filesystem=none $DEVPATH

# Find the TrueCrypt device:
TCDEV=$(/Applications/ -t -l | grep $DEVPATH | cut -d ' ' -f 3)

# Create a filesystem on the TrueCrypt device:
diskutil eraseVolume JHFS+ Scratch $TCDEV

# And destroy the key so this is a one-time use volume:

Note that:

  • The TrueCrypt volume that is created uses a random key file with no password. The random key file is created by dd if=$RAND of=$KEYFILE bs=1 count=4096. Remove that line and point KEYFILE= at a static file if you want a reusable container. BE SURE TO ALSO REMOVE THE LINE: srm $KEYFILE if you do, because that file line SECURELY ERASES THE KEY FILE!!!*
  • The random data for this script comes from the non-blocking random source /dev/urandom. Change to RAND=/dev/random for more security but slowdowns.
  • The device $DEVPATH WILL BE OVERWRITTEN BY THIS COMMAND!!!! Be absolutely sure you know what you're doing. To be safe, set DEVPATH to a file, like /tmp/some_file and append a --size=nnnn to the TrueCrypt line which creates the volume, where nnnn is the byte size of the file to create. Remove the --quick option. This will be much slower.
  • This works on Mac OS X. For Linux, use mkfs.ext3 rather than diskutil eraseVolume. Or just use mount -t tmpfs and encrypted swap ;-)
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.