4

I am changing the password of a truecrypt file container. This takes around 1 minute. Why?

time truecrypt --text --change /tmp/user1.tc --keyfiles= --new-keyfiles= --password=known --new-password=known --random-source=/dev/null"

If I use strace I see that it basically does not do anything: it simply reads lots of random data from /dev/urandom (even if i specified /dev/null as random source) and finally changes the password:

open("/dev/urandom", O_RDONLY)          = 6
read(6, "\36&{\351\212\212\343\202\34\313\242\312I\326\235\245\224\300\354O)\270Q\200 \201J\227\224\311_\212\367"..., 640) = 640
close(6)                                = 0
7

Truecrypt is generating a new key to be associated with the new passphrase. In order to achice the random nature to generate a secure key, truecrypt samples many different sources over a little while(1min). It's necessary for a new secure key. Using /dev/null is not recomended! Hope this clears it up.

| improve this answer | |
  • 4
    In fact, using /dev/null as a source for anything will not work, because the null device is only a "sink"; you can't read anything from it. The opposite would be /dev/zero, which is read-only and outputs null bytes... but really, using that as a "random number" source is asking to be shot. – user1686 May 31 '10 at 18:26
0

I successfully used this to create a random source:

         dd if=/dev/urandom of=/root/rn bs=1b count=320

I chose 320 because truecrypt prompts for 320 random chars if you don't specify an random source.

/dev/urandom is somewhat better than /dev/zero

truecrypt --text --change --keyfiles= --new-keyfiles= --password=pw --new-password=newpw --random-source=/root/rn /dev/xvgf1
| improve this answer | |
  • This sounds like its asking for trouble using this. I suggest one sticks with the default implementation. – Ramhound Mar 5 '13 at 12:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.