Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie
Hi all,
Vanilla are planning an update to the site on April 24th (next Wednesday). It is a major PHP8 update which is expected to boost performance across the site. The site will be down from 7pm and it is expected to take about an hour to complete. We appreciate your patience during the update.
Thanks all.

Truecrypt development stopped. Recommend changing to Bitlocker.

124»

Comments

  • #92
    anvilfour
    Closed Accounts Posts: 720 ✭✭✭anvilfour


    My name is URL wrote: »
    Someone should tell that to the VeraCrypt devs.

    I've been using it for the last few months

    Couldn't get Veracrypt to open on my Mac. Worked like a charm on Linux though.

    If you want a bottom up rewrite of the code I suppose there's always CipherShed.


  • #93
    BoB_BoT
    Registered Users Posts: 1,835 ✭✭✭BoB_BoT


    I know Security Now (Steve Gibson and Leo Laporte) did a podcast recently on a TrueCrypt audit, haven't had the time to listen to it yet, but will tonight/tomorrow. Quick scan of the podcast transcript, found the author of the report and the site it's audited on. https://opencryptoaudit.org/

    Again, haven't read it in full, but the gist is, it's still pretty viable, no gaping holes, some bad code, but nothing that can't be improved upon.


    Well feck, somehow managed to miss AnCatDubh's post, who already posted the report. Ignore the above :P


  • #94
    anvilfour
    Closed Accounts Posts: 720 ✭✭✭anvilfour


    BoB_BoT wrote: »
    I know Security Now (Steve Gibson and Leo Laporte) did a podcast recently on a TrueCrypt audit, haven't had the time to listen to it yet, but will tonight/tomorrow. Quick scan of the podcast transcript, found the author of the report and the site it's audited on.

    Again, haven't read it in full, but the gist is, it's still pretty viable, no gaping holes, some bad code, but nothing that can't be improved upon.


    Well feck, somehow managed to miss AnCatDubh's post, who already posted the report. Ignore the above :P

    The security concerns surround the Windows version only. There's a string of encrypted data in the volume headers which might contain the actual password to unlock the containers. Interestingly in the Linux version the same string of data is just a string of zeroes.

    Of course since it's no longer in active development, there's no real way yo can be sure of your data being safe so might be best to use something like Veracrypt.


  • #95
    BoB_BoT
    Registered Users Posts: 1,835 ✭✭✭BoB_BoT


    anvilfour wrote: »
    The security concerns surround the Windows version only. There's a string of encrypted data in the volume headers which might contain the actual password to unlock the containers. Interestingly in the Linux version the same string of data is just a string of zeroes.

    Of course since it's no longer in active development, there's no real way yo can be sure of your data being safe so might be best to use something like Veracrypt.

    Well that's it, will be best to use the newer forks. But we're also assuming that they're not working the same type of volume header encryption as truecrypt and that it's all above board, again it would need to be audited. Can you really trust anyone? :)


  • #96
    anvilfour
    Closed Accounts Posts: 720 ✭✭✭anvilfour


    BoB_BoT wrote: »
    Well that's it, will be best to use the newer forks. But we're also assuming that they're not working the same type of volume header encryption as truecrypt and that it's all above board, again it would need to be audited. Can you really trust anyone? :)

    You can trust open source code you've checked and compiled yourself - sadly in the case of Truecrypt it wasn't really possible to check that the Windows installer available on the website was compiled from the publicly available source code line for line - also it apparently is very convoluted and difficult to lock down!

    I suppose it's best to go with the traditional method of seeing security as a mindset and employing multiple layers of encryption...

    Even when I had a Truecrypt encrypted USB stick, this in turn contained an encrypted file container I had created with the program tomb (which is simply a very easy way to use Linux built in encryption tools dm-crypt and cryptsetup.

    I think the command line tool tcplay has previously been mentioned which can create Truecrypt style containers without any of the messy code and security concerns too.

    Take your pick! :)


  • Advertisement
  • #97
    BoB_BoT
    Registered Users Posts: 1,835 ✭✭✭BoB_BoT


    Encryption is like an onion, it can have many layers, then sometimes it just makes you cry. :P


  • #98
    Hotblack Desiato
    Registered Users Posts: 33,822 ✭✭✭✭Hotblack Desiato


    anvilfour wrote: »
    You can trust open source code you've checked and compiled yourself

    Ah but did you compile the compiler yourself - and did you compile the compiler you compiled the compiler with yourself - and did you compile the compiler you compiled the compiler you compiled the compiler with yourself - and...

    https://en.wikipedia.org/wiki/Backdoor_(computing)#Compiler_backdoors
    Thompson's paper describes a modified version of the Unix C compiler that would:
    - Put an invisible backdoor in the Unix login command when it noticed that the login program was being compiled, and as a twist
    - Also add this feature undetectably to future compiler versions upon their compilation as well.

    Because the compiler itself was a compiled program, users would be extremely unlikely to notice the machine code instructions that performed these tasks. (Because of the second task, the compiler's source code would appear "clean".) What's worse, in Thompson's proof of concept implementation, the subverted compiler also subverted the analysis program (the disassembler), so that anyone who examined the binaries in the usual way would not actually see the real code that was running, but something else instead.

    Life ain't always empty.



  • #99
    Khannie
    Moderators, Technology & Internet Moderators Posts: 37,485 Mod ✭✭✭✭Khannie


    That's so beautiful.


  • #100
    anvilfour
    Closed Accounts Posts: 720 ✭✭✭anvilfour


    Hotblack Desiato wrote: »
    Ah but did you compile the compiler yourself - and did you compile the compiler you compiled the compiler with yourself - and did you compile the compiler you compiled the compiler you compiled the compiler with yourself - and...

    Yes. :)


  • #101
    anvilfour
    Closed Accounts Posts: 720 ✭✭✭anvilfour


    Hotblack Desiato wrote: »
    Ah but did you compile the compiler yourself - and did you compile the compiler you compiled the compiler with yourself - and did you compile the compiler you compiled the compiler you compiled the compiler with yourself - and...

    On a more serious note, it seems from reading this month's Cryptogram newsletter, the CIA apparently did try to create a corrupted version of XCode in a vain attempt to undermine iOS. Of course they had no way to install the corrupted compiler on developers' machines...!


  • Advertisement
  • #102
    howamidifferent
    Registered Users Posts: 1,817 ✭✭✭howamidifferent


    Flaws discovered in Truecrypt.

    http://www.itworld.com/article/2987438/newly-found-truecrypt-flaw-allows-full-system-compromise.html


  • #103
    anvilfour
    Closed Accounts Posts: 720 ✭✭✭anvilfour


    howamidifferent wrote:
    Flaws

    Great article, thanks! Gratifying to know that the flaws have been fixed in Veracrypt, as I use Linux version.

    According to the article Windows users may still be using Truecrypt as there aren't many encryption options for the OS.

    Compare and contrast with Linux which has built in encryption options via tools like LUKS, dm-crypt and gpg - there really is no comparison when it comes to security! :)


  • #104
    BoB_BoT
    Registered Users Posts: 1,835 ✭✭✭BoB_BoT


    I'm going to wait the couple of days until he releases what the "flaws" are before moving any machine's over to Veracrypt.

    If it's a case where it's extremely complicated to reproduce the exact criteria to access the data, then it's not an immediate threat to the users I have on truecrypt. However, if it means the volumes/containers can be accessed externally (i.e. pop the hard drive out) with little difficulty, I'm going to have a very busy week.


  • #105
    anvilfour
    Closed Accounts Posts: 720 ✭✭✭anvilfour


    BoB_BoT wrote: »
    I'm going to wait the couple of days until he releases what the "flaws" are before moving any machine's over to Veracrypt.

    If it's a case where it's extremely complicated to reproduce the exact criteria to access the data, then it's not an immediate threat to the users I have on truecrypt. However, if it means the volumes/containers can be accessed externally (i.e. pop the hard drive out) with little difficulty, I'm going to have a very busy week.

    Do you have many machines using Truecrypt Bob? I completely understand your options on Windows are limited. It's a shame that Veracrypt can't open Truecrypt containers any more! :)

    Update : It seems according to Veracrypt FAQ that the software actually still can open Truecrypt volumes and can be installed alongside Truecrypt without any issues. We need more info as you say on what these flaws are! :)


  • #106
    beauf
    Closed Accounts Posts: 22,651 ✭✭✭✭beauf


    I still will use truecrypt for file containers. It's much handier than Vera. I just use it for privacy not security.

    I must try Vera again. I didn't like it the last time I tried it. Was a bit clunky.

    There's a few commercial options for windows. You see those a lot in big organisations.


  • #107
    anvilfour
    Closed Accounts Posts: 720 ✭✭✭anvilfour


    beauf wrote: »
    I still will use truecrypt for file containers. It's much handier than Vera. I just use it for privacy not security.

    I must try Vera again. I didn't like it the last time I tried it. Was a bit clunky.

    There's a few commercial options for windows. You see those a lot in big organisations.

    Can I ask beauf what you mean about using Truecrypt for privacy but not for security?

    As you say there are a few alternatives for Windows - I wonder though how many there are for system encryption - haven't used Windows for a long time! :)

    Update : My learned friends has pointed me to this website for encryption program alternatives, particularly if you don't fancy relying solely on Bitlocker.


  • #108
    beauf
    Closed Accounts Posts: 22,651 ✭✭✭✭beauf


    I just if I lose the device, laptop, flash drive, so regular scrotes can't muck with it. I doubt they'll be able to use these flaws to decrypt the data. I'm not encrypting any sensitive information. Or all my account details in the caymans. That warrants attention from someone more technical. I'd be more at risk from hacker exploiting some browser flaw, when I was logging on to something, or buying something.


  • #109
    anvilfour
    Closed Accounts Posts: 720 ✭✭✭anvilfour


    beauf wrote: »
    I just if I lose the device, laptop, flash drive, so regular scrotes can't muck with it. I doubt they'll be able to use these flaws to decrypt the data. I'm not encrypting any sensitive information. Or all my account details in the caymans. That warrants attention from someone more technical. I'd be more at risk from hacker exploiting some browser flaw, when I was logging on to something, or buying something.

    Ah, I see what you mean, you're not trying to protect yourself from jackbooted government thugs seizing your equipment so much as idiotic thieves who might break in and steal it, gotcha!

    You're right in saying that there are many more risks associated with going online. Then again if you encrypt your data on an airgapped machine you're very unlikely to have issues either way - not very helpful though if you want to buy an airline ticket online I admit! :)


  • #110
    beauf
    Closed Accounts Posts: 22,651 ✭✭✭✭beauf


    Indirectly I have that already. As my data is on encrypted external disks. Mainly because a SSD is my main disk and isn't big enough for the data anyway.


  • #111
    BoB_BoT
    Registered Users Posts: 1,835 ✭✭✭BoB_BoT


    Bit more detail on the actual vulnerabilities although not exactly how they're exploited. http://thehackernews.com/2015/09/truecrypt-encryption-software.html

    After reading the above, I'm still not overly worried. It sounds like the users have more chance of having their data hijacked by a piece of malware.

    The main concern I had is if the disk / flash drive could be removed from a device, plugged into another and decrypted without the encryption key. Anytime I've used truecrypt for laptops/pc's it was full disk encryption, time to move them onto something else I think. May even have to go down the managed encryption route.


  • Advertisement
  • #112
    BoB_BoT
    Registered Users Posts: 1,835 ✭✭✭BoB_BoT


    anvilfour wrote: »
    Do you have many machines using Truecrypt Bob? I completely understand your options on Windows are limited. It's a shame that Veracrypt can't open Truecrypt containers any more! :)

    Running it on a couple of personal machines, not so much on clients, except for some that just wanted basic encryption without the cost of management etc...
    I was using it on work flash drives for years, but moved to hardware based encryption for ease of use.

    Again I don't transport anything that's sensitive, but it'd be a pain in the hole and embarrassing if I potentially lost client data (sensitive or not) that could be picked up by someone off the street.


  • #113
    anvilfour
    Closed Accounts Posts: 720 ✭✭✭anvilfour


    BoB_BoT wrote: »
    Running it on a couple of personal machines, not so much on clients, except for some that just wanted basic encryption without the cost of management etc...
    I was using it on work flash drives for years, but moved to hardware based encryption for ease of use.

    Again I don't transport anything that's sensitive, but it'd be a pain in the hole and embarrassing if I potentially lost client data (sensitive or not) that could be picked up by someone off the street.

    Again this is one of the beauties of linux... the disk manager can format and encrypt a USB drive with AES straight out of the box... Pleased to hear you're keeping your customer's information safe, I wish all companies were that obliging! :)


  • #114
    trout
    Registered Users Posts: 9,920 ✭✭✭trout


    Just spotted this ... the German government sponsored Fraunhofer Institute for Secure Information Technology audit of TrueCrypt is complete; report is published.

    "Overall, the analysis did not identify any evidence that the guaranteed encryption characteristics are not fulfilled in the implementation of TrueCrypt. In particular, a comparison of the cryptographic functions with reference implementations or test vectors did not identify any deviations. The application of cryptography in TrueCrypt is not optimal. The AES implementation is not timing-resistant, key files are not used in a cryptographically secure way and the integrity of volume headers is not properly protected."

    http://sseblog.ec-spride.de/2015/11/truecrypt-analysis/

    http://www.theregister.co.uk/2015/11/23/truecrypt_anlaysis/

    Not exactly a ringing endorsement, nor a scathing criticism ... can't imagine too many people will change their habits as a result.


    tl;dr ... TrueCrypt, meh


  • #115
    DublinWriter
    Registered Users Posts: 9,555 ✭✭✭DublinWriter


    I always thought the issue with TrueCrypt was the storage of keys in the Windows .hib file?


  • #116
    anvilfour
    Closed Accounts Posts: 720 ✭✭✭anvilfour


    DublinWriter wrote: »
    I always thought the issue with TrueCrypt was the storage of keys in the Windows .hib file?

    Hi DublinWriter,

    There are a number of security concerns. My understanding is that Truecrypt can encrypt the hibernation file but in fairness to the manual on the website it does say that you can't rely on full disk encryption when a device is hibernated versus being fully shut down (indeed I ran afoul of this myself a few years back but that's another story!).

    You're right in saying though that one of the main concerns is with the Windows version. A string of random numbers is saved into the header of each volume for no good reason (in Linux the same area is just an encrypted string of zeroes).

    That said I suppose it's academic to debate it's trustworthiness now it's not in active development. I've had a fun time using Veracrypt on my Mac but as for Linux, it's probably best just to use the built in encryption tools.


  • #117
    anvilfour
    Closed Accounts Posts: 720 ✭✭✭anvilfour


    Just been reading the abstract of what seems to be a very interesting paper on how Police are responding to full disk encryption.

    See also here a few case studies where Police genuinely have been stumped by someone using Encryption.

    The first paper mentions the 'Iceman' Case:
    In the Max Ray Butler (Iceman) case, the digital investigators expected to encounter encryption and the on-scene search was planned accordingly to maximize the opportunity to gain access to running systems, whether they were locked or not. Gaining access to cryptographic data during the search permitted the subsequent decryption of his FDE systems and an assortment of encrypted containers on external drives. This greatly added to initial evidence of the sale of encoding data for several thousand credit cards, leading to Butler’s eventual conviction for the theft of data for nearly 2 million unique payment cards. It also gave investigators access to artifacts
    from more than a hundred intrusions over several years.

    So it seems that given enough resources and if the Police are aware you use FDE, it informs their procedures accordingly. I don't see anything too scary here though. Most of the strategies employed involve them being able to make a copy of a live system so as long as you keep your devices fully powered off, you don't have too much to worry about - also the techniques they employ wouldn't be much good if you'd stored your encrypted data on removable media.


Advertisement