6 ms·

If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; if you can find these projects and conv

by tptacek 3mo ago

If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; if you can find these projects and conveniently use them, state vendors can and will write scanners that find them. They're paid to do it; new detections are how they get to charge for maintenance and new versions. Then you're down to two issues: (1) Concealing an encrypted volume jacks suspicion way up; whatever pickle you were going to be in if you just kept an encrypted DMG on your desktop, you're trebly in now. (2) Your actual security comes down to the strength of the encrypted volume, and this is 20-year-old encryption. He can't use a memory-hard KDF because of his BOM, which, like, fair enough, but that doesn't change the fact that this KDF is probably ~50x faster than standard bcrypt hardness and on realistic human passwords is probably crackable in minutes-to-hours on a dedicated rig. I winced particularly at the observation that the hardness was set where it is because of how long it takes to open the encrypted volume on this hardware, because whatever scheme is being used to run the KDF now, an attacker won't bother; they'll just copy the bits and attack them on serious hardware. Point (1) isn't meaningful if your adversaries aren't states. It might make sense to have a hidden encrypted volume for the same reason you'd want an encrypted safe. But point (2) applies to everybody.

johnnyApplePRNG 3mo ago
>If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; This would evade 99% of them. Most "state-level" adversaries are just high school dropouts working border jobs told to "investigate suspicious things". I once had a police officer literally raid my room for drugs during a massive party we were throwing in university, for example. They took everything. They found everything. Everything except for the $1,000 piece of drug paraphernalia I had sitting right out in open view in the middle of the apartment... the Volcano vaporizer. It didn't look like anything they had seen before so they didn't think anything of it. Same would be true with this USB drive in 99% of border crossing privacy invasions... plug in USB, ask for password, read it/copy it/whatever... they're not taking it apart and performing open heart surgery on a $5 USB drive at the border. They might throw it out... or keep it or something... sure... but in general... this is a hell of a lot better than a regular USB drive imho.
- matheusmoreira 3mo ago
  > It didn't look like anything they had seen before so they didn't think anything of it. You will miss your government's incompetence when they start rectifying these failures. I know I do. They are the tyrants who oppress us with a clean conscience. They never rest and have infinite money. Their occasional episodes of bumbling incompetence is the only respite, but those won't last. Especially now with AI to think for them.
  - pixl97 3mo ago
    Ya. Especially when were at the point they know you know about hidden encrypted disks because they have your full internet history for the last 10 years. I guess it's human nature to build the Torment Nexus.
    - deleted 3mo ago
      [deleted]
    - brookst 3mo ago
      Actually I’ve found some flaws in the Torment Nexus and have a PR to improve it.
- tptacek 3mo ago
  This is self-soothing, not a real security plan. It doesn't matter how competent a security agency is, because there's a whole ecosystem of vendors selling into that space; knowledge of how to attack encrypted disks like this is outsourced, and, importantly, those firms have incentives to mop up even random stuff like this, because vendors will be selected in part based on lists of how many different circumvention and privacy tools they can detect.
  - LorenPechtel 3mo ago
    This isn't stand-up-to-state-actors security. This is keep-state-actors-from-noticing security. They know you're guilty, they'll get it. The XKCD version of password cracking works no matter how secure your hardware. But while states realistically can crack most anything it doesn't mean they can crack *every*thing. There are simply too many flash drives crossing the border every day. But there is a big flaw I see: 8gb. You're carting around an 8gb flash drive these days??
Retr0id 3mo ago
> If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; I kinda assumed this was a solved problem now, up to the information-theoretic limit. Just create a FAT32 fs (for example), put some boring decoy files on it, and then unmount it. Traverse the FAT to map which blocks are in-use vs not-in-use, and use the not-in-use ones to store your encrypted data in some arbitrary header-free indistinguishable-from-random format. The result should look just like someone had set up a FAT filesystem on top of a securely erased drive. If anyone ever mounts and subsequently writes to the FAT volume they'll clobber your data - oh well. The remaining issue is that you need some special software on the host to mount the hidden volume, which itself raises suspicions. This could be solved by bundling it with OSes by default.
- pixl97 3mo ago
  >This could be solved by bundling it with OSes by default. Apple and Microsoft? I trust apple a bit more and MS none at all. Linux is a bit different because the kernel is the OS, but only a small part of all its different packages. Also you'll have to watch it like a hawk because nation states will constantly try to compromise it.
- jandrese 3mo ago
  Doesn't FAT have the concept of "badblocks" to handle the old days when sectors could randomly fail on drives and they had to work around it? It would only be slightly more suspicious but it would allow the drive to be mounted and used as a regular drive to avoid the even more suspicious unmounted volume issue. The data in the sectors would obviously be encrypted so it looks like random noise if someone does start poking around looking at it.
  - Retr0id 3mo ago
    It does, but it's extremely unusual for the feature to be in use on modern hardware. I thought of a much simpler approach though. Personally, it's completely normal for my USB drives to contain some OS installer dd'd to the first few GB, and to be wiped with urandom between uses. The installer .iso is typically immutable and will never expand beyond its initial size. Rather than mess around with block mappings, I can just use last n GB as a hidden storage volume. dm-crypt "plain" mode is headerless and can be configured to start from some offset within the underlying block device. The only giveaway here might be forensic examination of the drive's internal wear-leveling data.
amelius 3mo ago
Someone should write a disk formatting utility that randomizes the bits on your drive. Now you can claim that any encrypted drive (which just looks like pure noise if done correctly) is a drive that was just formatted.
- fhdkweig 3mo ago
  Be careful in countries like UK which have laws requiring the decryption of any data they find. There are people sitting in jail because they couldn't decrypt the "random noise" on their computers.
  - ErroneousBosh 3mo ago
    > There are people sitting in jail because they couldn't decrypt the "random noise" on their computers. No, there isn't.
  - NikolaNovak 3mo ago
    Fair warning; any links to specific cases (not the law itself)?
    - fhdkweig 3mo ago
      This lists two unnamed individuals. https://edri.org/our-work/edri-gramnumber7-16decrypt-data-cases-ripa/ https://edri.org/our-work/edri-gramnumber7-16decrypt-data-ca...
      - marysol5 3mo ago
        None of which are what OP is claiming
      - prmoustache 3mo ago
        They don't mention anything about data being claimed as random noise nor the sentences.
  - monster_truck 3mo ago
deleted 3mo ago
[deleted]
palmotea 3mo ago
> If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; if you can find these projects and conveniently use them, state vendors can and will write scanners that find them. They're paid to do it; new detections are how they get to charge for maintenance and new versions. How would those scanners work? If the device presents itself as a bog-standard usb drive, with all the same identification strings, etc., and the hidden volume is completely inaccessible until triggered (e.g. like swapping on sd card for another), it seems like such a scanner would have to rely on things like precise timing and performance characteristics vs what the drive presents as, and there are a lot of legitimate USB drives out there to characterize. Edit: and if that's the case, maybe pick a lower-performance drive to mimic (and use its case). Then have some kind of characterization step to add custom delays to match its timing and performance characteristics. > (2) Your actual security comes down to the strength of the encrypted volume, and this is 20-year-old encryption. He can't use a memory-hard KDF because of his BOM, which, like, fair enough, but that doesn't change the fact that this KDF is probably ~50x faster than standard bcrypt hardness and on realistic human passwords is probably crackable in minutes-to-hours on a dedicated rig. I agree. What's the point of doing on-device encryption? Seems like this device should only do the volume-swapping bit. Once it "it unmounts [the unhidden section] and remounts the second hidden section, you should have to decrypt that hidden section with soemthing like VeraCrypt.
- StilesCrisis 3mo ago
  Given that the name defaults to "Phantomdrive" I have a hunch that it is not as fully nondescript as you are suggesting it ought to be.
ErroneousBosh 3mo ago
> Concealing an encrypted volume jacks suspicion way up; whatever pickle you were going to be in if you just kept an encrypted DMG on your desktop, you're trebly in now. Time to bust out the old "Can't tell if this MP3 is a steganographically important encrypted file or just a Nurse With Wound EP" trick then.
- ButlerianJihad 3mo ago
  There once was a time when I'd be on Facebook all day, subscribed to many groups and pages that published really dank memes. And I would enjoy laughing at these memes, and the dankest memes I would duly collect and forward to my mother who is a boomer. And my mother would duly sift through these forwarded meme images for the dankest of the dank, and then she would eagerly forward them to her friend from church, who also had a large distribution list, and so that is how I became a conduit for the dankest GenZ Facebook memes to the boomer generations in another state. And then I became a Cybersecurity educator, and our curriculum contained a module on steganography, and we all had the students do a proof-of-concept where they cryptographically embedded secret messages in innocent-looking photograph files. And that is where my meme-sharing came to a screeching halt, and I deleted every meme I ever collected, and I unsubbed from every possible source, and I began completely ignoring memes, and my mother's distribution dried up. Good god that was absolutely shocking. I have no idea what sort, if any, secret messages I was responsible for, and I hope that we never ever find out!
  - dude187 3mo ago
    I'm pretty sure the meme WAS the message. What other messages are being distributed through random meme sharing, where the recipient has to know it contains some secondary hidden message and requires the means to decode it?!
    - ButlerianJihad 3mo ago
      It didn't matter; once I found out even the possibilities for steganography across a large catalog of JPEG images, it was game over for me. It doesn't matter if there were zero or five dozen secret messages in the files I forwarded. I didn't want to be a conduit for that possibility. The risk, of becoming a mule, an unwitting accessory to some evil cause, was just far outweighing the rewards of sharing dumb crap with my mother, you know?
aeturnum 3mo ago
I often see comments like this on encryption related project. Depending on the reader you make what might be an essential point - but I also don't really know how useful it is to say it here. The author makes no claims about what adversaries this should be sufficient against and is completely open about their constraints and decisions (allowing you to make the critique in the first place). Basically evading a state-level actor is going to be hard. People do get lucky but to evade them in a straight-up contest you need to very clever (if it's possible at all). Given that, I just dunno how useful it is to emblazen warnings on AES-based encryption schemes that it won't fool the NSA. Either the person reading it is not technically equipped to evaluate the claims and may be scared off of a solution that protects against some adversaries while searching for an impossible zero-config state-proof solution. Or the person already knew as soon as they saw 'AES' that this isn't the project they need. I don't mean to denigrate the inclination to highlight weaknesses like this - good communication around this is genuinely challenging.
- tptacek 3mo ago
  I'm generally pretty fatalistic about avoiding state-level adversaries. So, in a sense, it doesn't really matter how one thinks a security countermeasure is going to stack up against an IC attacker. The important thing is that people understand how hard this is to do, and take that into consideration before adopting tools like these. You can easily make things worse for yourself. I think this post is a fun technical case study on its own. It only takes on urgency because it literally markets itself as a tool to slip past state adversaries. I think it's important that people understand that it isn't the state itself that's going to take the time to detect something like this; it's some commercial forensics vendor they use automatically.
  - rectang 3mo ago
    A while ago I participated in security design for an open source foundation. (Security is not a specialty of mine, but I aspire to be competent enough for my role as a developer working in web dev and open source.) We attempted to design our processes to assure some level of defense against state-level threat actors despite assuming we could not keep them out of our network. The main goal was to ensure an audit trail in the event that our source repositories or release archives were compromised and changed.
Dylan16807 3mo ago
You can compensate for not just 50x but 500x by adding 2 characters to your password. If that's the speedup factor, it's not itself a big worry.
- tptacek 3mo ago
  You can eliminate the problem entirely by using a random full-allowed-character-set password. The whole point of KDFs is that the password/passphrase is predictable (usually: by being generated from a seed dictionary).
  - Dylan16807 3mo ago
    Random is important, character set not so much. And yes when I say 2 characters I mean random ones. Even 26x26 is plenty to compensate. Or you can add one random word.
    - tptacek 3mo ago
      We're both saying the same thing: you can make the KDF irrelevant if you (as you just specified) use an AES key as an input. The entire point of KDF is that humans don't do that.
      - Dylan16807 3mo ago
        No, what I'm saying is: If your password was good enough for a quality KDF, then improving it to use a 50x worse KDF is very easy. If the worse one requires you "use an AES key", then the good one pretty much also required you to "use an AES key". If the good one didn't require that, then the 50x worse one also doesn't require that. Generate a single letter and slap it on the end, or human-pick two letters. 50x is not the decider between allowing a good password and allowing a bad password. It's a tiny little nudge. Edit: To put "little nudge" another way, if you have a 1-10 scale of password quality, most steps in that scale are going to be more than 5.6 bits apart.
        3mo ago
cyberax 3mo ago
One possible trick: round down the normal volume size to the nearest 1Gb and encrypt it (who doesn't use encryption today?!?) and use it for non-secret data with a password that you're willing to divulge if pressed. This is innocuous enough. Then use the rest of the drive (~1Gb) for a hidden TrueCrypt volume with a secure key.
phyzome 3mo ago
This is probably fine for evading local cops. I'll also note that anyone plugging this into a forensics machine is going to have a bit of a dilemma: Perform write tests, or not? Because if they probe it with password:... attempts to check on timing leakage, that's potentially damaging evidence.
- marysol5 3mo ago
  You do not do any writes in a forensics scenario. Especially if you want to make it stand in court. You have to always keep a clean hashed copy, and then work on copies from there.
  - phyzome 3mo ago
    You can't make a "clean hashed copy" of hardware.
deleted 3mo ago
[deleted]
deleted 3mo ago
[deleted]
machinehum 3mo ago
6x not 50x I use 100k rounds instead of 600k https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html https://cheatsheetseries.owasp.org/cheatsheets/Password_Stor...
Ntrails 3mo ago
At the risk of being dumb, wouldn't an easier solution be physical? ie have a usb stick with two actual "disks" and a an appropriately obscured physical switch to define what plugging it in actually does? Again, this isn't going to beat someone who knows you've got something to hide, they can physically deconstruct/analyse the drive, but at least it's not going to be found by automatic scanning/software etc?

by tptacek 3mo ago

johnnyApplePRNG 3mo ago

>If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; This would evade 99% of them. Most "state-level" adversaries are just high school dropouts working border jobs told to "investigate suspicious things". I once had a police officer literally raid my room for drugs during a massive party we were throwing in university, for example. They took everything. They found everything. Everything except for the $1,000 piece of drug paraphernalia I had sitting right out in open view in the middle of the apartment... the Volcano vaporizer. It didn't look like anything they had seen before so they didn't think anything of it. Same would be true with this USB drive in 99% of border crossing privacy invasions... plug in USB, ask for password, read it/copy it/whatever... they're not taking it apart and performing open heart surgery on a $5 USB drive at the border. They might throw it out... or keep it or something... sure... but in general... this is a hell of a lot better than a regular USB drive imho.

matheusmoreira 3mo ago
> It didn't look like anything they had seen before so they didn't think anything of it. You will miss your government's incompetence when they start rectifying these failures. I know I do. They are the tyrants who oppress us with a clean conscience. They never rest and have infinite money. Their occasional episodes of bumbling incompetence is the only respite, but those won't last. Especially now with AI to think for them.
- pixl97 3mo ago
  Ya. Especially when were at the point they know you know about hidden encrypted disks because they have your full internet history for the last 10 years. I guess it's human nature to build the Torment Nexus.
  - deleted 3mo ago
    [deleted]
  - brookst 3mo ago
    Actually I’ve found some flaws in the Torment Nexus and have a PR to improve it.
tptacek 3mo ago
This is self-soothing, not a real security plan. It doesn't matter how competent a security agency is, because there's a whole ecosystem of vendors selling into that space; knowledge of how to attack encrypted disks like this is outsourced, and, importantly, those firms have incentives to mop up even random stuff like this, because vendors will be selected in part based on lists of how many different circumvention and privacy tools they can detect.
- LorenPechtel 3mo ago
  This isn't stand-up-to-state-actors security. This is keep-state-actors-from-noticing security. They know you're guilty, they'll get it. The XKCD version of password cracking works no matter how secure your hardware. But while states realistically can crack most anything it doesn't mean they can crack *every*thing. There are simply too many flash drives crossing the border every day. But there is a big flaw I see: 8gb. You're carting around an 8gb flash drive these days??

Retr0id 3mo ago

> If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; I kinda assumed this was a solved problem now, up to the information-theoretic limit. Just create a FAT32 fs (for example), put some boring decoy files on it, and then unmount it. Traverse the FAT to map which blocks are in-use vs not-in-use, and use the not-in-use ones to store your encrypted data in some arbitrary header-free indistinguishable-from-random format. The result should look just like someone had set up a FAT filesystem on top of a securely erased drive. If anyone ever mounts and subsequently writes to the FAT volume they'll clobber your data - oh well. The remaining issue is that you need some special software on the host to mount the hidden volume, which itself raises suspicions. This could be solved by bundling it with OSes by default.

pixl97 3mo ago
>This could be solved by bundling it with OSes by default. Apple and Microsoft? I trust apple a bit more and MS none at all. Linux is a bit different because the kernel is the OS, but only a small part of all its different packages. Also you'll have to watch it like a hawk because nation states will constantly try to compromise it.
jandrese 3mo ago
Doesn't FAT have the concept of "badblocks" to handle the old days when sectors could randomly fail on drives and they had to work around it? It would only be slightly more suspicious but it would allow the drive to be mounted and used as a regular drive to avoid the even more suspicious unmounted volume issue. The data in the sectors would obviously be encrypted so it looks like random noise if someone does start poking around looking at it.
- Retr0id 3mo ago
  It does, but it's extremely unusual for the feature to be in use on modern hardware. I thought of a much simpler approach though. Personally, it's completely normal for my USB drives to contain some OS installer dd'd to the first few GB, and to be wiped with urandom between uses. The installer .iso is typically immutable and will never expand beyond its initial size. Rather than mess around with block mappings, I can just use last n GB as a hidden storage volume. dm-crypt "plain" mode is headerless and can be configured to start from some offset within the underlying block device. The only giveaway here might be forensic examination of the drive's internal wear-leveling data.

amelius 3mo ago

Someone should write a disk formatting utility that randomizes the bits on your drive. Now you can claim that any encrypted drive (which just looks like pure noise if done correctly) is a drive that was just formatted.

fhdkweig 3mo ago
Be careful in countries like UK which have laws requiring the decryption of any data they find. There are people sitting in jail because they couldn't decrypt the "random noise" on their computers.
- ErroneousBosh 3mo ago
  > There are people sitting in jail because they couldn't decrypt the "random noise" on their computers. No, there isn't.
- NikolaNovak 3mo ago
  Fair warning; any links to specific cases (not the law itself)?
  - fhdkweig 3mo ago
    This lists two unnamed individuals. https://edri.org/our-work/edri-gramnumber7-16decrypt-data-cases-ripa/ https://edri.org/our-work/edri-gramnumber7-16decrypt-data-ca...
    - marysol5 3mo ago
      None of which are what OP is claiming
    - prmoustache 3mo ago
      They don't mention anything about data being claimed as random noise nor the sentences.
- monster_truck 3mo ago

deleted 3mo ago

[deleted]

palmotea 3mo ago

> If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; if you can find these projects and conveniently use them, state vendors can and will write scanners that find them. They're paid to do it; new detections are how they get to charge for maintenance and new versions. How would those scanners work? If the device presents itself as a bog-standard usb drive, with all the same identification strings, etc., and the hidden volume is completely inaccessible until triggered (e.g. like swapping on sd card for another), it seems like such a scanner would have to rely on things like precise timing and performance characteristics vs what the drive presents as, and there are a lot of legitimate USB drives out there to characterize. Edit: and if that's the case, maybe pick a lower-performance drive to mimic (and use its case). Then have some kind of characterization step to add custom delays to match its timing and performance characteristics. > (2) Your actual security comes down to the strength of the encrypted volume, and this is 20-year-old encryption. He can't use a memory-hard KDF because of his BOM, which, like, fair enough, but that doesn't change the fact that this KDF is probably ~50x faster than standard bcrypt hardness and on realistic human passwords is probably crackable in minutes-to-hours on a dedicated rig. I agree. What's the point of doing on-device encryption? Seems like this device should only do the volume-swapping bit. Once it "it unmounts [the unhidden section] and remounts the second hidden section, you should have to decrypt that hidden section with soemthing like VeraCrypt.

StilesCrisis 3mo ago
Given that the name defaults to "Phantomdrive" I have a hunch that it is not as fully nondescript as you are suggesting it ought to be.

ErroneousBosh 3mo ago

> Concealing an encrypted volume jacks suspicion way up; whatever pickle you were going to be in if you just kept an encrypted DMG on your desktop, you're trebly in now. Time to bust out the old "Can't tell if this MP3 is a steganographically important encrypted file or just a Nurse With Wound EP" trick then.

ButlerianJihad 3mo ago
There once was a time when I'd be on Facebook all day, subscribed to many groups and pages that published really dank memes. And I would enjoy laughing at these memes, and the dankest memes I would duly collect and forward to my mother who is a boomer. And my mother would duly sift through these forwarded meme images for the dankest of the dank, and then she would eagerly forward them to her friend from church, who also had a large distribution list, and so that is how I became a conduit for the dankest GenZ Facebook memes to the boomer generations in another state. And then I became a Cybersecurity educator, and our curriculum contained a module on steganography, and we all had the students do a proof-of-concept where they cryptographically embedded secret messages in innocent-looking photograph files. And that is where my meme-sharing came to a screeching halt, and I deleted every meme I ever collected, and I unsubbed from every possible source, and I began completely ignoring memes, and my mother's distribution dried up. Good god that was absolutely shocking. I have no idea what sort, if any, secret messages I was responsible for, and I hope that we never ever find out!
- dude187 3mo ago
  I'm pretty sure the meme WAS the message. What other messages are being distributed through random meme sharing, where the recipient has to know it contains some secondary hidden message and requires the means to decode it?!
  - ButlerianJihad 3mo ago
    It didn't matter; once I found out even the possibilities for steganography across a large catalog of JPEG images, it was game over for me. It doesn't matter if there were zero or five dozen secret messages in the files I forwarded. I didn't want to be a conduit for that possibility. The risk, of becoming a mule, an unwitting accessory to some evil cause, was just far outweighing the rewards of sharing dumb crap with my mother, you know?

aeturnum 3mo ago

I often see comments like this on encryption related project. Depending on the reader you make what might be an essential point - but I also don't really know how useful it is to say it here. The author makes no claims about what adversaries this should be sufficient against and is completely open about their constraints and decisions (allowing you to make the critique in the first place). Basically evading a state-level actor is going to be hard. People do get lucky but to evade them in a straight-up contest you need to very clever (if it's possible at all). Given that, I just dunno how useful it is to emblazen warnings on AES-based encryption schemes that it won't fool the NSA. Either the person reading it is not technically equipped to evaluate the claims and may be scared off of a solution that protects against some adversaries while searching for an impossible zero-config state-proof solution. Or the person already knew as soon as they saw 'AES' that this isn't the project they need. I don't mean to denigrate the inclination to highlight weaknesses like this - good communication around this is genuinely challenging.

tptacek 3mo ago
I'm generally pretty fatalistic about avoiding state-level adversaries. So, in a sense, it doesn't really matter how one thinks a security countermeasure is going to stack up against an IC attacker. The important thing is that people understand how hard this is to do, and take that into consideration before adopting tools like these. You can easily make things worse for yourself. I think this post is a fun technical case study on its own. It only takes on urgency because it literally markets itself as a tool to slip past state adversaries. I think it's important that people understand that it isn't the state itself that's going to take the time to detect something like this; it's some commercial forensics vendor they use automatically.
- rectang 3mo ago
  A while ago I participated in security design for an open source foundation. (Security is not a specialty of mine, but I aspire to be competent enough for my role as a developer working in web dev and open source.) We attempted to design our processes to assure some level of defense against state-level threat actors despite assuming we could not keep them out of our network. The main goal was to ensure an audit trail in the event that our source repositories or release archives were compromised and changed.

Dylan16807 3mo ago

You can compensate for not just 50x but 500x by adding 2 characters to your password. If that's the speedup factor, it's not itself a big worry.

tptacek 3mo ago
You can eliminate the problem entirely by using a random full-allowed-character-set password. The whole point of KDFs is that the password/passphrase is predictable (usually: by being generated from a seed dictionary).
- Dylan16807 3mo ago
  Random is important, character set not so much. And yes when I say 2 characters I mean random ones. Even 26x26 is plenty to compensate. Or you can add one random word.
  - tptacek 3mo ago
    We're both saying the same thing: you can make the KDF irrelevant if you (as you just specified) use an AES key as an input. The entire point of KDF is that humans don't do that.
    - Dylan16807 3mo ago
      No, what I'm saying is: If your password was good enough for a quality KDF, then improving it to use a 50x worse KDF is very easy. If the worse one requires you "use an AES key", then the good one pretty much also required you to "use an AES key". If the good one didn't require that, then the 50x worse one also doesn't require that. Generate a single letter and slap it on the end, or human-pick two letters. 50x is not the decider between allowing a good password and allowing a bad password. It's a tiny little nudge. Edit: To put "little nudge" another way, if you have a 1-10 scale of password quality, most steps in that scale are going to be more than 5.6 bits apart.
      - 3mo ago

cyberax 3mo ago

One possible trick: round down the normal volume size to the nearest 1Gb and encrypt it (who doesn't use encryption today?!?) and use it for non-secret data with a password that you're willing to divulge if pressed. This is innocuous enough. Then use the rest of the drive (~1Gb) for a hidden TrueCrypt volume with a secure key.

phyzome 3mo ago

This is probably fine for evading local cops. I'll also note that anyone plugging this into a forensics machine is going to have a bit of a dilemma: Perform write tests, or not? Because if they probe it with password:... attempts to check on timing leakage, that's potentially damaging evidence.

marysol5 3mo ago
You do not do any writes in a forensics scenario. Especially if you want to make it stand in court. You have to always keep a clean hashed copy, and then work on copies from there.
- phyzome 3mo ago
  You can't make a "clean hashed copy" of hardware.

deleted 3mo ago

[deleted]

deleted 3mo ago

[deleted]

machinehum 3mo ago

6x not 50x I use 100k rounds instead of 600k https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html https://cheatsheetseries.owasp.org/cheatsheets/Password_Stor...

Ntrails 3mo ago

At the risk of being dumb, wouldn't an easier solution be physical? ie have a usb stick with two actual "disks" and a an appropriately obscured physical switch to define what plugging it in actually does? Again, this isn't going to beat someone who knows you've got something to hide, they can physically deconstruct/analyse the drive, but at least it's not going to be found by automatic scanning/software etc?