Hash decrypts key, key decrypts cipher... why? I noticed recently that a couple of pieces of encryption software (TrueCrypt being one of them) don't directly use a hash of the password as the key for the block cipher. Instead, they generate a random key, use that to encrypt the data, then xor the key with the hash of the password and store the result within the encrypted file's header.

I can see this being useful from the perspective of wanting different keys for different files, even though the password is the same, but I can't think of any other reason. Are hashes weak as block cipher keys, or am I missing something here? Are there any additional security considerations to think about with this kind of mechanism? Also, is this mechanism superior to using keyed HMAC hashes, where the file contains the key?
There are several reasons to use a scheme like this:


As several other answers have pointed out, it allows changing the password without re-encrypting the entire file.
Also, it allows re-encrypting the file without changing the password, should this be desired.  In particular, a careful implementation can allow incremental re-encryption, so that the file can be accessed while the re-encryption process is running, and so that the re-encryption process can be safely resumed even if the computer crashes while it's running.
Using an intermediate key also allows multiple passwords to be defined for the same file without having to store all the data twice &mdash; just encrypt the same inner key with each password and store them all in the header.

It's also possible to support other authentication methods besides plain passwords; for example, the inner key could be encrypted with the public half of a public/private key pair (RSA, DSA, etc.), with the private key perhaps in turn stored in an encrypted key file and/or on removable media.  You could even have the file accessible both with a password and with a private key file if you like.

(For technical and performance reasons, you do not want to use public-key crypto algorithms to directly encrypt large files, so in practice, whenever you use such keys for file encryption, this is exactly what you do anyway &mdash; encrypt the file with a random symmetric key and then encrypt the random key with the public key.)
And yes, it also ensures that two identical files encrypted with the same password won't have the same ciphertext.  Granted, there are other ways of ensuring this, but it's still a useful side effect.