6 ms·

Those results do not really inspire confidence. Shipping an ancient version of zlib without patching, ever, is an avoidable mistake. The GOST 28147-89 cipher ba

Those results do not really inspire confidence. Shipping an ancient version of zlib without patching, ever, is an avoidable mistake. The GOST 28147-89 cipher basically cannot be used with XTS due to the cipher's 64-bit block size, which should have been caught by a good crypto engineer. Also, the most significant new work - the UEFI support - seems to have quite a few issues. Note that, despite the color-coding, the list of fixed issues is not the list of critical (red) issues!

2bitencryption 10y ago
TrueCrypt inspired confidence in me because the way the dev team operated displayed true expertise and professionalism. Maybe I perceived that incorrectly, but that's how I felt. VeraCrypt has always seemed like someone swooped down and forked TrueCrypt the moment it became abandoned, to grab all its faithful users. Now, that's a bit dramatic, and probably not entirely true. But that's how it always felt to me -- ANYONE can just fork TrueCrypt. Why should I trust these guys in particular?
- mhogomchungu 10y ago
  TrueCrypt went belly up in May,2014[1] VeraCrypt 1.0 was released in May,2013[2]. One year prior. [1] http://truecrypt.sourceforge.net http://truecrypt.sourceforge.net [2] https://sourceforge.net/u/yanpas/veracrypt/ci/VeraCrypt_1.0b/tree/ https://sourceforge.net/u/yanpas/veracrypt/ci/VeraCrypt_1.0b...
- paavokoya 10y ago
  The way in which TrueCrypt "became abandoned" does not inspire confidence as well. Considering they left a cryptic and very strange exit note that many perceived as a notice of law enforcement activity.
  - Nition 10y ago
    If anything that cryptic abandonment actually gave me more confidence in TrueCrypt. Was it so hard to crack that the government shut it down?
    - paavokoya 10y ago
      I meant confidence in what came after it. Meaning the likelihood of a backdoored and/or weak software was likely.
      - tptacek 10y ago
        This is the "NSAKEY" of open source crypto conspiracy theories.
        quickben 10y ago
        As far as I recall, there are 8 bytes set to zero in the TC header at a very curious location.
        tptacek 10y ago
        That's always how these worst backdoors begin... with curious patterns of zeroes. How better to zero out a key than with actual zeroes. Nobody will ever suspect!
      - Nition 10y ago
        Ah I get what you meant now, I agree. If some entity already had their eye on TrueCrypt and had shut it down, you wouldn't expect them to let a copycat pop up unless it was less secure.
  - goatsi 10y ago
    The strongest evidence I have seen is that the developer was arrested by the DEA on unrelated charges.[0] The full story about him is fascinating and well worth the read.[1] [0] http://www.newyorker.com/news/news-desk/the-strange-origins-of-truecrypt-isiss-favored-encryption-tool http://www.newyorker.com/news/news-desk/the-strange-origins-... [1] https://mastermind.atavist.com/ https://mastermind.atavist.com/
    - acqq 10y ago
      It's not a developer of TrueCrypt but of E4M. At the time TrueCrypt was developed Le Roux was busy with doing crimes. https://en.wikipedia.org/wiki/E4M https://en.wikipedia.org/wiki/E4M https://en.wikipedia.org/wiki/Paul_Le_Roux https://en.wikipedia.org/wiki/Paul_Le_Roux Although TrueCrypt existed since 2004 he ordered his employees around 2007 to use E4M (which would be improbable if he really developed TrueCrypt). The developer (or developers) of TrueCrypt isn't publicly known.
- bad_user 10y ago
  VeraCrypt is currently maintained by Mounir Idrassi, which is like a real person with a name. VeraCrypt is also actively developed, the big issue solved in version 1.8 being to add support for UEFI GPT drives, which is actually a big deal. TrueCrypt was developed by an anonymous developer that vanished, abandoning the project. Funny how trust works.
  - deleted 10y ago
    [deleted]
FieryTransition 10y ago
Valid points, though I would consider the requirements for writing really secure software quite high, so I do not think most open source projects could meet such standards. Maybe it could be compared to developing mission critical software, like Nasa for example. The amount of resources and rigor they use to get bugs out of the code is out of the scope of most free/donation software projects. There are probably a few open source projects which gets close to being considered secure though, mostly those which are very used and backed by big companies or foundations. So we have Veracrypt as the 'good enough' option right now and ease of use, but you shouldn't happen to know any secure alternatives? You seem to know a bit about this.
- nickpsecurity 10y ago
  "though I would consider the requirements for writing really secure software quite high, so I do not think most open source projects could meet such standards. " Data from prior work indicates it ranges considerably from significantly harder to extremely hard. The LOCK system with an Orange Book A1 development process was highly secure and gave cost breakdown. A1 assurance acyivities added around 37% or so on top of regular, labor cost. Altran/Praxis's Correct-by-Construction that does highly-assured systems with mix of Z specs, Ada, SPARK, reviews, and testing costs 50% premium on top of normal development. Just using SPARK automatically knocks out whole classes of bugs. Galois did and open-sourced CRYPTOL so people can specify algorithms in easy DSL then generate C from it. Also parser and protocol generators. So, prior evidence shows it takes specialized skill and domain knowledge... at least two extra people unless one has both... but otherwise costs 30-50% more time. Like Cleanroom methodology, it partly achieved this by saving you time debugging and refactoring due to reduced bugs in general plus doing fixes earlier in lifecycle. Most OSS projects dont do this stuff just because they dont know it's necessary, don't care, or don't have staff for both demanded features and assurance activities. Interestingly, there's more high-assurance products in proprietary than FOSS software despite the huge labor advantage FOSS has. That there's little of even medium-assurance work in majority of both says even worse things about IT's priorities or apathy given medium assurance cost little to nothing. Microsoft is the one exception of big, software houses via SDL and MS Research's work. For FOSS, DJB, OpenBSD, and SQLite come to mind.
leeoniya 10y ago
> Note that, despite the color-coding, the list of fixed issues is not the list of critical (red) issues! yikes, one hell of an oversight
whamlastxmas 10y ago
UEFI support is HUGE. So happy to see this. Finally we're nearing a feasible open-source solution for FDE on modern laptops running Windows.

2bitencryption 10y ago

TrueCrypt inspired confidence in me because the way the dev team operated displayed true expertise and professionalism. Maybe I perceived that incorrectly, but that's how I felt. VeraCrypt has always seemed like someone swooped down and forked TrueCrypt the moment it became abandoned, to grab all its faithful users. Now, that's a bit dramatic, and probably not entirely true. But that's how it always felt to me -- ANYONE can just fork TrueCrypt. Why should I trust these guys in particular?

mhogomchungu 10y ago
TrueCrypt went belly up in May,2014[1] VeraCrypt 1.0 was released in May,2013[2]. One year prior. [1] http://truecrypt.sourceforge.net http://truecrypt.sourceforge.net [2] https://sourceforge.net/u/yanpas/veracrypt/ci/VeraCrypt_1.0b/tree/ https://sourceforge.net/u/yanpas/veracrypt/ci/VeraCrypt_1.0b...
paavokoya 10y ago
The way in which TrueCrypt "became abandoned" does not inspire confidence as well. Considering they left a cryptic and very strange exit note that many perceived as a notice of law enforcement activity.
- Nition 10y ago
  If anything that cryptic abandonment actually gave me more confidence in TrueCrypt. Was it so hard to crack that the government shut it down?
  - paavokoya 10y ago
    I meant confidence in what came after it. Meaning the likelihood of a backdoored and/or weak software was likely.
    - tptacek 10y ago
      This is the "NSAKEY" of open source crypto conspiracy theories.
      - quickben 10y ago
        As far as I recall, there are 8 bytes set to zero in the TC header at a very curious location.
        tptacek 10y ago
        That's always how these worst backdoors begin... with curious patterns of zeroes. How better to zero out a key than with actual zeroes. Nobody will ever suspect!
    - Nition 10y ago
      Ah I get what you meant now, I agree. If some entity already had their eye on TrueCrypt and had shut it down, you wouldn't expect them to let a copycat pop up unless it was less secure.
- goatsi 10y ago
  The strongest evidence I have seen is that the developer was arrested by the DEA on unrelated charges.[0] The full story about him is fascinating and well worth the read.[1] [0] http://www.newyorker.com/news/news-desk/the-strange-origins-of-truecrypt-isiss-favored-encryption-tool http://www.newyorker.com/news/news-desk/the-strange-origins-... [1] https://mastermind.atavist.com/ https://mastermind.atavist.com/
  - acqq 10y ago
    It's not a developer of TrueCrypt but of E4M. At the time TrueCrypt was developed Le Roux was busy with doing crimes. https://en.wikipedia.org/wiki/E4M https://en.wikipedia.org/wiki/E4M https://en.wikipedia.org/wiki/Paul_Le_Roux https://en.wikipedia.org/wiki/Paul_Le_Roux Although TrueCrypt existed since 2004 he ordered his employees around 2007 to use E4M (which would be improbable if he really developed TrueCrypt). The developer (or developers) of TrueCrypt isn't publicly known.
bad_user 10y ago
VeraCrypt is currently maintained by Mounir Idrassi, which is like a real person with a name. VeraCrypt is also actively developed, the big issue solved in version 1.8 being to add support for UEFI GPT drives, which is actually a big deal. TrueCrypt was developed by an anonymous developer that vanished, abandoning the project. Funny how trust works.
- deleted 10y ago
  [deleted]

FieryTransition 10y ago

Valid points, though I would consider the requirements for writing really secure software quite high, so I do not think most open source projects could meet such standards. Maybe it could be compared to developing mission critical software, like Nasa for example. The amount of resources and rigor they use to get bugs out of the code is out of the scope of most free/donation software projects. There are probably a few open source projects which gets close to being considered secure though, mostly those which are very used and backed by big companies or foundations. So we have Veracrypt as the 'good enough' option right now and ease of use, but you shouldn't happen to know any secure alternatives? You seem to know a bit about this.

nickpsecurity 10y ago
"though I would consider the requirements for writing really secure software quite high, so I do not think most open source projects could meet such standards. " Data from prior work indicates it ranges considerably from significantly harder to extremely hard. The LOCK system with an Orange Book A1 development process was highly secure and gave cost breakdown. A1 assurance acyivities added around 37% or so on top of regular, labor cost. Altran/Praxis's Correct-by-Construction that does highly-assured systems with mix of Z specs, Ada, SPARK, reviews, and testing costs 50% premium on top of normal development. Just using SPARK automatically knocks out whole classes of bugs. Galois did and open-sourced CRYPTOL so people can specify algorithms in easy DSL then generate C from it. Also parser and protocol generators. So, prior evidence shows it takes specialized skill and domain knowledge... at least two extra people unless one has both... but otherwise costs 30-50% more time. Like Cleanroom methodology, it partly achieved this by saving you time debugging and refactoring due to reduced bugs in general plus doing fixes earlier in lifecycle. Most OSS projects dont do this stuff just because they dont know it's necessary, don't care, or don't have staff for both demanded features and assurance activities. Interestingly, there's more high-assurance products in proprietary than FOSS software despite the huge labor advantage FOSS has. That there's little of even medium-assurance work in majority of both says even worse things about IT's priorities or apathy given medium assurance cost little to nothing. Microsoft is the one exception of big, software houses via SDL and MS Research's work. For FOSS, DJB, OpenBSD, and SQLite come to mind.

leeoniya 10y ago

> Note that, despite the color-coding, the list of fixed issues is not the list of critical (red) issues! yikes, one hell of an oversight

whamlastxmas 10y ago

UEFI support is HUGE. So happy to see this. Finally we're nearing a feasible open-source solution for FDE on modern laptops running Windows.