Is it safe to use the same password/secret for both VeraCrypt volume and its HMAC? I am trying to script the integrity check of a VeraCrypt volume.
#! /bin/sh

red=$'\e[1;31m'
end=$'\e[0m'

set -e

printf &quot;Please enter password: &quot;

read -s p

if [ -f &quot;/Volumes/Samsung BAR/bar.hmac&quot; ]; then
  printf &quot;\n%s&quot; &quot;Checking integrity...&quot;
  if [ &quot;$(openssl dgst -sha512 -hmac "$p&quot; &quot;/Volumes/Samsung BAR/bar&quot;)&quot; != &quot;$(&lt;"/Volumes/Samsung BAR/bar.hmac")" ]; then
    printf "\n%s" "${red}Check failed${end}&quot;
    exit 1
  fi
fi

printf &quot;\n%s\n&quot; &quot;Unlocking VeraCrypt volume...&quot;

veracrypt --text --non-interactive --mount --pim 0 --keyfiles &quot;&quot; --protect-hidden no --password &quot;$p&quot; &quot;/Volumes/Samsung BAR/bar&quot; /Volumes/Backup

declare -a files=(
  &quot;/Users/sunknudsen/.gnupg&quot;
  &quot;/Users/sunknudsen/.ssh&quot;
  &quot;/Users/sunknudsen/Library/Keychains&quot;
)

for file in &quot;${files[@]}"; do
  rsync -axRS --delete "$file&quot; /Volumes/Backup
done

open /Volumes/Backup

printf &quot;${red}Inspect backup and press enter${end}&quot;

read -r answer

veracrypt --text --dismount &quot;/Volumes/Samsung BAR/bar&quot;

echo &quot;Saving HMAC...&quot;

openssl dgst -sha512 -hmac &quot;$p&quot; &quot;/Volumes/Samsung BAR/bar&quot; &gt; &quot;/Volumes/Samsung BAR/bar.hmac&quot;

echo &quot;Done&quot;

Security warning: Using read -s p is vulnerable to process listing leaks so I need to find another way to feed the password to both openssl and veracrypt.
Assuming your password is secure, yes it is (and I've seen your YouTube channel so I guess that's a non-issue). If you use the same key in both, an attacker would still have to find your key. Since your data this encrypted this requires breaking either the encryption or the HMAC'd hash - even if the hash is broken, they may find a collision but your key would be significantly harder to obtain, since collisions usually don't involve finding the original data.
The point of HMAC is to pair the data with the hash. Someone may tamper with the data, but without the key they can't make the hash collide with the new data. You can use one or multiple keys, it really doesn't matter.
Also, don't forget to store 2 separate hashes. That way, if one has a collision attack developed later on, you can still verify the authenticity using the other. SHA-512 and BLAKE2b? (C'mon, don't tell me forked their official implementation for nothing)
Just kidding, but really... Store the hash with 2 separate algorithms.