My USB Drive Has a Hidden Encrypted Vault • Hacker News Board

Re: My USB Drive Has a Hidden Encrypted Vault

#171

Post by SAI_Peregrinus » Fri, Jul 24, 2026, 2:56 PM UTC

Dylan16807 wrote: post #51

tptacek wrote: post #49

Earlier quoted context omitted.

We're both saying the same thing: you can make the KDF irrelevant if you (as you just specified) use an AES key as an input. The entire point of KDF is that humans don't do that.

No, what I'm saying is: If your password was good enough for a quality KDF, then improving it to use a 50x worse KDF is very easy. If the worse one requires you "use an AES key", then the good one pretty much also required you to "use an AES key". If the good one didn't require that, then the 50x worse one also doesn't require that. Generate a single letter and slap it on the end, or human-pick two letters. 50x is no…

To add (and agree), if you've got (say) a 10-word Diceware-style passphrase with ≥128 bits of entropy, the point of a KDF becomes solely for the domain separation that KDFs provide. That's not particularly relevant for the USB drive case, but it's very useful in the general case of deriving keys. If I'm writing encryption software for my own use where I know I'll be generating a secure (≥128 bits of entropy) passphrase, I just use HKDF or Blake3's KDF mode.

Re: My USB Drive Has a Hidden Encrypted Vault

#172

Post by awesome_dude » Fri, Jul 24, 2026, 7:52 PM UTC

mingus88 wrote: post #94

NetMageSCW wrote: post #87

Earlier quoted context omitted.

Try to explain how the hidden content would be found? It effectively doesn’t exist until the password is in place. It isn’t hidden, it isn’t connected at all.

I’m no expert but I can imagine a scenario where an x-ray scan can notice an SD card embedded into the controller and flag that for follow-up SD card the author says was added to offset the cost of eMMC but would presumably stand out as anomalous with whatever AI is classifying the scan

I mean - if there are multiple sdcards in the device - and they each contain a hidden partition - how is the X-RAY going to determine that the reported 5GB (or whatever) isn't matching the devices actual 7GB (for example)

Re: My USB Drive Has a Hidden Encrypted Vault

#173

Post by ThePowerOfFuet » Sat, Jul 25, 2026, 11:03 AM UTC

ThePowerOfFuet wrote: post #119

monster_truck wrote: post #110

Earlier quoted context omitted.

Have you actually compared the random data that various tools write to a disk to encrypted files? Load up binwalk and give it a rip, you will be surprised by how distinct the entropy graph is between the two

What you propose ("the random data that various tools write to disk") is not _random data_. Compare the entropy graph of /dev/random against a LUKS volume with a decrypted header, and you will see no difference.

s/decrypted/detached/

Re: My USB Drive Has a Hidden Encrypted Vault

#174

Post by [deleted] » Mon, Jul 27, 2026, 7:20 PM UTC

NetMageSCW wrote: post #87

mediaman wrote: post #71

Earlier quoted context omitted.

He's saying they just plug your USB stick into some gizmo sold to the state, and it's going to find enough to escalate it. If the idea is that there's no point in encrypting anything on a USB stick, and you just hope they don't look at it at all, sure. But there is no threat model here that includes "check the USB stick" and does not automatically lead to finding and breaking "hidden" content.

Try to explain how the hidden content would be found? It effectively doesn’t exist until the password is in place. It isn’t hidden, it isn’t connected at all.

[deleted]

Re: My USB Drive Has a Hidden Encrypted Vault

#175

Post by throwawayffffas » Mon, Jul 27, 2026, 7:25 PM UTC

johnnyApplePRNG wrote: post #5

tptacek wrote: post #3

If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; if you can find these projects and conveniently use them, state vendors can and will write scanners that find them. They're paid to do it; new detections are how they get to charge for maintenance and new versions. Then you're down to two issues: (1) Concealing an encrypted volume jacks suspicion w…

>If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; This would evade 99% of them. Most "state-level" adversaries are just high school dropouts working border jobs told to "investigate suspicious things". I once had a police officer literally raid my room for drugs during a massive party we were throwing in university, for example. They took everyth…

> This would evade 99% of them.

> Most "state-level" adversaries are just high school dropouts working border jobs told to "investigate suspicious things"

Famous last words. Do not underestimate the police, they have been doing this longer than you, they typically have highly sophisticated people working for them, and at the border they have enormous resources behind them.