If I create a TrueCrypt container and use a keyfile(s) instead of a typical password could someone looking at the container knowing nothing about it know that it uses a keyfile instead of a password?
2 Answers
Short answer: No
Long answer: Check out the documentation at truecrypt.org, in particular: http://www.truecrypt.org/docs/?s=volume-format-specification for details on how the volumes are built.
As I understand it from reading that, only the first 64 bytes are unencrypted and they're simply a salt & random. Absolutely no information in that and the rest is encrypted, requiring you to know the password. I'm afraid you're not getting anything out of it.
-
Not trying to break into one mind you; I was just wondering if someone would know if I used a set of key files as opposed to a traditional password. Still that link answered a few questions for me, thanks! Feb 9, 2011 at 15:45
-
Oh I never thought that. Its a very valid question. Truecrypt do do a lot of explaining about what can be detected (but not read) and what can't, most notably in the full disk encryption section. One of the issues though is how many 'random' files do you actually have on your machine... Unformatted drives I guess are easier to explain. My last sentence was simply meant to sum things up, rather than warn.– PriceyFeb 9, 2011 at 19:42
TrueCrypt containers are designed to look like white noise: if you don't know what it is, there's no information to see.
-
1So looking at an encrypted partition/file sitting on a hard drive, there's no way to tell what it is? Feb 8, 2011 at 17:06
-
@Bob: Correct, there's no way to tell if it's using a keyfile or not. It's possible to guess that it's an encrypted container, because it's a sizeable file comprised of very random data - no normal file is made up like that. Feb 8, 2011 at 18:56
-
1There isn't even a marker in the file that says, "I'm a TrueCrypt file." Feb 8, 2011 at 19:34