New effort to fully audit TrueCrypt raises $16,000+ in a few short weeks

http://arstechnica.com/security/2013/10/new-effort-to-fully-audit-truecrypt-raises-over-16000-in-a-few-short-weeks/

by laurent123456 • 13 years ago

168 97 13 years ago

dmix3• 13 years ago

I've abandoned truecrypt for Tomb in the meantime http://www.dyne.org/software/tomb/

free6522• 13 years ago

Interesting I'll take a look. I need a backup system for my gf (basically a wife) to decrypt my drive in case of my passing. I had a truecrypt volume, now I switched back to OSX encryption.

It's basically a drive (in a safe deposit box) with all of my stuff there, also with a copy of my lastpass passwords unencrypted. My gf knows our phrase, 50 characters no less. Took me few months to teach her it.

diminoten10• 13 years ago

Here's a 58 character phrase:

    You always find something in the very last place you look.

I wonder how many months it'd take to learn that. :-/

x0054• 13 years ago

Few months? How about "anAardvarkAndAHippoAreNeverFriends@" easy to remember and almost impossible to brake. Worst case, lets say that attacker actually knows that the password is 6 words with a special character at the end. Lets further assume that the attacker knows that the words are not overly complicated, say from a subset of 5,000, and the special character is one of the 10 that's easy to type on the keyboard. Even than, at the speed of 10 million passwords per second it would take 500 million years (just about) to crack that one, and no need for months of memorization.

cryptocascadia• 13 years ago

zuluCrypt [1] replaced TrueCrypt for me.

"zuluCrypt is a front end to cryptsetup and tcplay. It makes it easy to manage LUKS,PLAIN and TRUECRYPT encrypted volumes through a GUI and a simpler to use CLI interface."

If you can handle experimental CLI-driven software, pbp [2] is interesting.

"PBP is a simple python wrapper and a command line interface around libsodium, to provide basic functionality resembling PGP. It uses scrypt for a KDF and a much simpler packet format, which should be much harder to fingerprint, pbp also provides an experimental forward secrecy mode and a multi-party DH mode."

[1] https://code.google.com/p/zulucrypt/

[2] https://github.com/stef/pbp

https://aur.archlinux.org/packages/zulucrypt/

https://aur.archlinux.org/packages/python2-pbp

cantrevealname7• 13 years ago

Let's not forget that an enormous number of people in the world still use Windows. We need a secure, reliable, and free solution for them. The only app that currently fills these requirements for Windows is TrueCrypt.

That's why I think it's a great idea to do a security audit of TrueCrypt since that's the best available solution for a big segment of the world's population.

mhogomchungu• 13 years ago

There is the truecrypt binary and truecrypt formatted encrypted volume.The format of the truecrypt volume is known and there exists open source solutions that can create and open truecrypt volumes.

All it will take to have alternatives in windows is for windows based block device encryption applications to pick up the format.It is surprising it hasnt happened yet and this drive is completely ignoring this line of thinking.

shawnz• 13 years ago

We need a secure, reliable, and free solution for them. The only app that currently fills these requirements for Windows is TrueCrypt.

What's wrong with BitLocker?

EDIT: Keep in mind we are just talking about Windows solutions here. And if Windows is backdoored, it is not going to make much difference if BitLocker is also backdoored by the same agency.

j_s• 13 years ago

DiskCryptor has the opposite problem: it's Windows-only.

http://diskcryptor.net/wiki/Main_Page/en

mavroprovato• 13 years ago

Personally, I have trouble trusting people who write thngs like "Windowz" and "Winslows" on their product home page.

thex86• 13 years ago

Cool! Maybe, finally, as a result of public scrutiny, TrueCrypt will have a public repository. You know, it's 2013. I cannot think of any reason why the software you will possibly trust with your life does not have code in a public repository.

Till then time, we will and we should doubt it.

voltagex_• 13 years ago

If only I could raise 16k to get 7-zip some actual source control, too...

cantrevealname7• 13 years ago

the software ... does not have code in a public repository

Yes, TrueCrypt should use a revision control system like Git or SVN. However, your comment can be misinterpreted as saying that TrueCrypt doesn't release source code at all.

It's worth mentioning that the full source code is available ( here: http://www.truecrypt.org/downloads2 ).

dmishe3• 13 years ago

So um how do we know that none of the people conducting this audit are secretly working for NSA?

Somewhat james bond-y idea but you get the point.

dublinben• 13 years ago

In theory, it shouldn't matter. A public audit is public, so the work can be scrutinized by anyone.

tptacek2• 13 years ago

This is the new Slashdot "First Post", isn't it?

dmishe3• 13 years ago

What?

simias• 13 years ago

It's more like the new "imagine a beowulf cluster of these" meme, a comment generic enough that can fit most stories while contributing nothing to the discussion.

They could have settled for "I, for one, welcome our new NSA overlords".

krapp2• 13 years ago

How do we know you're not working for the NSA to undermine the credibility of the audit?

balabaster2• 13 years ago

How do we know you're not working for the NSA to undermine the undermining of the credibility of the audit? :P

dmishe3• 13 years ago

That's exactly the point

wahsd• 13 years ago

Hate to break it to you and others; but there is a high degree of likelihood that it is actually even an NSA funded operation, not to mention having assets that add backdoors.

How do you prevent and deflect efforts to develop a truely secure solution? ...You provide a solution that works and looks shiny and nice and defuses any kind of efforts. It's jiujitsu.

laurent123456• 13 years ago

There’s just one problem: no one knows who created the software.

What do they mean by this? Do we literally don't know who created Truecrypt?

yeukhon• 13 years ago

One thing for sure it is based on another software. See History (http://www.truecrypt.org/docs/version-history2)

1.0
February 2, 2004
Note: TrueCrypt 1.0 is based on E4M (Encryption for the Masses). Therefore, the following list contains differences between E4M 2.02a and TrueCrypt 1.0 (minor differences have been omitted).

cantrevealname7• 13 years ago

Do we literally don't know who created Truecrypt?

Yes, that's right. (The very earliest version was based on work 13 years ago by Paul Le Roux, but it's undergone enormous work since then by some person or group.)

TrueCrypt is a popular, carefully designed, well written, well maintained, highly stable and non-trivial application, but its authors are completely unknown. The open source world does have some quiet humble people, but it seems surprising that the authors want to remain totally anonymous for developing a legitimate and well-respected product.

hrktb• 13 years ago

Interesting. About anonymity, there is always the case where you don't want people knocking at your door to ask for backdoors, hidden vulnerabilities or any other requests about the software that you don't want to deal with.

cLeEOGPw• 13 years ago

Same with bitcoin. Is it that good knowledge of cryptography somehow makes the author to hide it's identity?

16s• 13 years ago

People continually discover this and are shocked to learn that the authors are anonymous. This has been a known fact since at least 2005. The authors of TC are anonymous and have been for a very, very long time.

mynameishere2• 13 years ago

Here's the thing...if any government organization actually goes through a truecrypt backdoor or flaw, the odds are very good that the news will get out. Yeah, if they seize a computer, crack it and never provide the unencrypted information to a court or other public forum (and somehow shut-up the perpetrator), they could keep it secret. But what's the point?

cantrevealname7• 13 years ago

Your claim is that use of decrypted information would reveal the backdoor.

I'll offer the Enigma cipher as a counterexample:

The British were regularly reading and acting upon encrypted German messages in 1940. It may have changed the course of World War II! The Germans did not learn that the British had broken the code despite German ships being sunk based on the Enigma crack. In fact, nobody in the public knew until 1974. ( ref: http://en.wikipedia.org/wiki/Ultra#Post-war_disclosures )

A government organization could make good use of a TrueCrypt backdoor without it ever being revealed in court or a public forum. They can act on the information using a pretext for example.

mynameishere2• 13 years ago

I'm trying to imagine a parallel circumstance and I cannot. Most governments would not use truecrypt, but rather something they have control of themselves. The people using truecrypt illicitly are ordinary criminals: Gangsters, child pornographers, terrorists (maybe), money-launderers, drug dealers, etc. The information revealed by a crack is not something that can be used in the manner of that by espionage. (ie, it won't tell us that Rommel will be approaching Cairo at such-and-such a date.) Information via espionage can be filtered down as if it were from other intelligence sources, or even guessing. And so the exploit can be concealed as with Ultra.

But to use truecrypt against the people who are actually using it for crime you would almost certainly have to reveal the exploit publicly in a court.

kbart• 13 years ago

Read about "parallel construction" to get an idea, it was on news few months ago.. http://www.reuters.com/article/2013/08/05/us-dea-sod-idUSBRE...

devx• 13 years ago

I hope they've taken a snapshot of the software before announcing the crowdfunding campaign. If there has been any update since then, and it had any backdoor, it may have already been removed.

kevinpet• 13 years ago

Apparently TrueCrypt still has the crazy license which no one can quite figure out if it's an amateur attempt to write an open source license, or an extremely subtle trap to lure people into thinking it's an open source license so that they can later sue.

nodata2• 13 years ago

It's not open source: http://opensource.org/licenses

richardfontana2• 13 years ago

The absence of the TrueCrypt license on the OSI-certified list itself does not signify much, since the license was AFAIK never submitted for OSI approval, but Linux distros among others have raised concerns about several versions of the license in the past, and the current one continues to be problematic IMO. Some recent discussion has been going on on the OSI license-discuss mailing list for those interested: see http://projects.opensource.org/pipermail/license-discuss/201... and followup messages.

(Disclaimer: am an OSI director and also am Red Hat lawyer who was involved in reviewing and rejecting the TrueCrypt license for Fedora.)

jordigh• 13 years ago

I wonder why they refuse to simply pick a standard free license. They obviously have been able to change the license a number of times, so it's not like it's a problem of having to get permission from all of the copyright holders...

rdl2• 13 years ago

The best thing someone could do for TrueCrypt security is to very publicly release a version with a backdoor, easily exploited, and difficult to detect, for anyone else to distribute. By making that a real threat, users will end up checking their source/compilation/results, protecting them against the same threat from real attackers.

cantrevealname7• 13 years ago

That might be a cute object lesson in good security practice for the security cognoscenti, but the overwhelming majority of potential users in the world will just throw up their hands in despair and say that we can trust anything and privacy is impossible.

If we want ordinary people to benefit from TrueCrypt, a better idea would be to find secure ways of distributing signed and verified copies of the binary. I'm saying binary because most users in the world will be ordinary Windows and Mac users, not software developers. Most people in the world cannot compile from source.

Also, as a first step, we need to do this security audit of TrueCrypt.

rdl2• 13 years ago

(Not saying auditing truecrypt is bad; I'll probably donate some $ once I get back to the US)

This problem already exists, and is actually something Mac App Store, iOS/iTunes store, and Google Play do a pretty good job of solving; I assume there are some similar solutions for Windows (I don't really know the windows consumer software distribution space).

The extensions improvements in Chrome/Firefox (and I guess other browsers, but I don't follow them) also are a great step forward toward this.

Ubuntu/Debian do a pretty good job of locking down main repositories, too. It's really just a matter of training users that downloading random code from random URLs is risky.

Once locked-down distribution hits critical mass, you can probably get away with making it even more difficult and obvious-to-the-user-he-is-doing-something-risky in "sideloading" applications. You can also have corp/org security policies which prohibit this kind of thing.

Obviously there are sacrifices for this -- it becomes possible for a platform owner to restrict availability of apps based on non-security considerations, like being anti-porn (Apple), complying with the union of laws of all countries, etc. Or just outright commercial anti-competitiveness (again, mostly Apple...)

New effort to fully audit TrueCrypt raises $16,000+ in a few short weeks

Related Stories