Truecrypt: Keyfiles and Encryption Keys

I want to put up two things about about Truecrypt today. First topic is how to generate your own keyfile. Second, is about how to increase the security of your working Truecrypt.

You can basically use any files as a keyfile. However, for the paranoid, you can use the internal keyfile generator.


Just run it off Tools, and you'll be presented with a generator. Move your mouse as randomly as possible for them to generate the encryption strength of the keyfile.


Save them and you'll have your own keyfile. FYI, you can even change the name of the keyfile into inconspicuous filename such as .tmp or .old.


We're coming to the interesting part here. You see, you increase the risk of your Truecrypt being hacked if you left it running. Let's say if it is running at this moment, and there's a program written to intercept your memory, they can see the encryption key which is used to dynamically read/write into your encrypted volume. Let's say you use Windows hibernate option. Some software can be used to extract the hibernate file, and the extract the encryption key which is used to open your encrypted volume.


To combat this issue, make sure you enable the auto-dismount options. As seen here: make sure you tick on Users logs off, Screen saver is launched and Entering power saving mode. As for the bottom part, just make sure Wipe cached passwords on auto-dismount. This should get the system to automatically wipe the password cache (password cache is used to access the encryption key).

Now, there are also some programs that could monitor protected memory. All I can say is: only mount your encrypted volume if you need to access your files. If you have no need for it, do not leave it mounted.

Truecrypt: Part 3 - Ideas of Using Truecrypt

Basically now you should have learn how to create and mount your encrypted volume. So how do you utilize it?

Use it as a portable secure data.
After you have created the encrypted file volume, you can transport this file everywhere with a thumb drive. Truecrypt is also available on Linux so you're covered in terms of accessibility. A paranoid friend of mine does this: carry a Truecrypt volume on his thumb drive, and got the keyfile set up on another. Basically in order to access his volume, you would have to stick in the two thumb drives, doubling as security.

Back up your mail, address or even calendar.
If you're running a client email such as Outlook, chances are you're download your email into this archive file. This archive file could be moved into the encrypted volume and once the volume was dismounted, Outlook won't display the archive folder. This is an extra security if you want to keep your email private from prying eyes. Well, private as in nobody could access this without you mounting the volume first.

Storing Items on office server space
You want to backup personal accounts on company server but afraid your company's IT might take a look? Create a volume and mount it up as normal. IT should have a hard time. Better yet, use Keepass in conjunction for a total secure access in case they install a keylogger on your computer.

Truecrypt: Part 2 - Mounting Volume

If you have read my previous post, you should learn how to create an encrypted volume. If you haven't figure out how to mount your volume, this post is going to show you how to mount it.



01. First, select the blank drive that is unused. For this post, I'll be using the Z: drive. I like to use unused drive starting backwards. Make sure you click Select File to load the encrypted file volume to mount.


02. Put in the password. Or if you've used keyfiles, use the keyfiles option.


03. After you mounted the encrypted volume, it should display on the drive you've selected with the size and the encryption algorithm.


04. If you check our My Computer file system, you'll see that the volume is listed as a drive.

Now, you can dump all the files that you need to secure into the drive. If you check screenshot 03 now, it has this Dismount button. The moment you click that button, the drive will disappear and no one without the proper password or keyfiles is able to access your files ever again.

To access your file, remount the encrypted volume file.

Next: More ideas on how you could utilize this technology for your own privacy!

Truecrypt: Part 1 - Creating Volume

This post is a continuation of my previous post about Truecrypt. If you want to create a secure and encrypted volume on your local hard drive, this post is about creating that volume. As of this moment, the version I'm using is Truecrypt 7.1a. If you have something later, usually the user interface shouldn't differ much unless the developer revamps the whole UI.




01. Click on Volumes and then Create New Volume...


02. As an example, I'll create an encrypted file container. For advanced user, you can encrypt the whole partition or drive making it a super secure container but at a cost of mobility (a friend of mine tried it and apparently he cannot find a way to move this partition to a thumb drive - DUH!).


03. Here comes the interesting part about Truecrypt. They basically offer you a standard container or two-volume container that contains a hidden volume. The best thing about using the second option is that if you're in a high risk operation and are in constant danger, you could create a dummy volume and when being interrogated, you give out the dummy password. The dummy password would still work and it'll open a different part of the partition. Paranoid Android: Make sure to put in your 'files' and 'folders' to disguise them like the real thing you're trying to cover up.


04. Click on Select Files and place where your file is going to be.


05. This is also another feature I liked about Truecrypt. Although they have their de-facto standard ".TC"extension, you can basically use any extension. In this example, I opt not to use any extension at all. Paranoid Android: You could use ZIP. If you drop a Truecrypt encrypted files into any Zip software, chances are they will tell you that it's corrupted and there is no way to conclude that the file is originally a Zip file. Alternatively, you could use TMP file and drop it on Windows temp directory and no one's the wiser (Paranoid Android: be careful of cleaning software that will clean up TMP files!).


06. We have come to the encryption option.


07. I'm not a hardcore encryption expert, but if you want any explanation, you have to Google them up. If logic serves me right, I rather choose a triple encryption (Paranoid Android: Although sometimes that might be the case). For an example in this post, I'll choose AES-Twofish-Serpent.


08. Choose the size that you would want to create. For the sake of this post, I'll go with 10 MB. After specifying the size, the program would immediately create the encrypted file with that size. Just be careful of the amount of free space that you still have on your hard drive!


09. You need to use a password. However, instead of using a password you could use a keyfile. Basically a keyfile is a system whereby Truecrypt uses a file as a cypher key instead of a password. Paranoid Android: Don't forget, you can combine both password and keyfiles together! (Keyfiles as in multiple files). A true paranoid geek might put his encrypted volume in a thumb drive and put the keyfiles in a separate thumb drive. Also, disguise your keyfiles as part of the filing system such as a bunch of word files or album pictures.

Do take note that these keyfiles are real and usable files. For example if you can use a working JPG or PDF file as a keyfile.


10. The system also generates its internal cypher. Therefore, move your mouse and type in something on another window to gather as much random numbers as possible.


11. Basically you're done.

Now that you learn how to create a volume, I'm going to continue in the next series to show you how to mount the encrypted file into a drive.

Truecrypt: Introduction

If you want to store some files in a secure local place, look no further than Truecrypt. So what does Truecrypt do?

Basically what it does is that it creates a huge encrypted file, which will be mounted as a virtual drive. Copy or move files into this virtual drive and when encrypted file is closed, this drive will disappear and there is no way to access the previously copied files unless this encrypted file is reopen with password. If for the paranoids, there's a bunch of encryption to choose from, ranging from AES to Twofish. For the ultra-paranoids, use keyfiles and tie them together with the password to create an ultra-secure encrypted file system.


And best of all it's encrypted on the fly, so there is no lag when files are copied from hard drive into the virtual drive.

The best deal that I've seen here is that that you can copy this encrypted files to a thumb drive and use them as a encrypted drive. I'll write more about using the Truecrypt in my next post.