4 ms·

"In her witness statement submitted to the British court on Friday, Detective Superintendent Caroline Goode, who said she was in charge of Scotland Yard's Snowd

"In her witness statement submitted to the British court on Friday, Detective Superintendent Caroline Goode, who said she was in charge of Scotland Yard's Snowden-related investigation, said that among materials officials had seized from Miranda while detaining him was an "external hard drive" containing data encrypted by a system called "True Crypt," which Goode said "renders the material extremely difficult to access." Goode said the hard drive contained around 60 gigabytes of data, "of which only 20 have been accessed to date." She said that she had been advised that the hard drive contains "approximately 58,000 UK documents which are highly classified in nature, to the highest level." Isn't this supposed to be very unlikely to happen when using TrueCrypt? Can someone explain what could have gone wrong in the process of storing this data?

superuser2 13y ago
See also: http://www.jsonline.com/news/crime/west-allis-man-indicted-on-federal-child-porn-charges-b9984158z1-221218841.html http://www.jsonline.com/news/crime/west-allis-man-indicted-o... It would appear that governments are able to somewhat efficiently bruteforce TrueCrypt volumes and access a little bit of data at a time. I couldn't get anyone interested in this article, but I would also like to know what's going on here. If a TrueCrypt volume can be broken for a small-time case of a child porn possession, that would seem to have dramatic ramifications for the security of pretty much everything in the world. Unless RSA is still solid and it's just TrueCrypt. Can any crypto experts comment?
- rwmj 13y ago
  They said on the news that he had the password written down on a piece of paper (which was also seized / found during the search). I don't think there's any mystery here.
  - pbhjpbhj 13y ago
    That sounds like a line they'd use to try and cover up the abilities of GCHQ (or whoever) to access such filesystems. If they had the password then what prevented them from accessing the whole volume?
  - superuser2 13y ago
    If they found the password, they would have all the drive. Not just part of it. Right?
- lawnchair_larry 13y ago
  That article provides no suggestion whatsoever that the government is able to efficiently bruteforce truecrypt. I think everyone can agree that if any part of the government had better-than-brute force capabilities for truecrypt, the FBI would absolutely not be allowed to disclose or make use of that capability in a child porn case. More likely explanations: Forensics recovered the password from an unencrypted volume, or he had a really dumb password, and he probably reused it somewhere.
- venomsnake 13y ago
  RSA is asymmetrical algorithm. They rely on mathematical problems being hard. TrueCrypt use symmetrical - AES Twofish and Serpent and you can even cascade them. RSA and AES have nothing in common. So a mathematical breakthrough in RSA will not help at all with making AES insecure.
lawnchair_larry 13y ago
The problem with assessing the statement is that it went through multiple people who don't have first hand knowledge of the actual incident, and who don't have a technical understanding of what they are even talking about. Details are subtle but they matter.
justincormack 13y ago
Apparently he had the password written down, and there were instructions and a key on the disk, according to various stories. Seems like Snowden gave them the key or something it seems odd.
deleted 13y ago
[deleted]
cnvogel 13y ago
If one believes the report of the NY Times, I'd doubt that hewould have left traces of files left on the computer they took with them, the article explicitly mentions Poitras (who Miranda alegedly had met in Berlin) wiping harddrives completely before crossing borders: http://www.nytimes.com/2013/08/18/magazine/laura-poitras-snowden.html http://www.nytimes.com/2013/08/18/magazine/laura-poitras-sno... Also, with TrueCrypt (or any other well-designed full disk encryption software) I'd not expect single files to be discovered, it should be either all or nothing.
JosephRedfern 13y ago
I don't know much about RSA/TrueCrypt... but surely a file ordered: A+B+C+D+E+F+G wouldn't be stored as enc(A)+enc(B)+enc(C)+enc(D)+enc(E)+enc(F)+enc(G). If they are able to access 20GB of the volume, what would stop them from accessing the other 40GB?
sp332 13y ago
Truecrypt allows "hidden volumes" to reside inside the same encrypted volume. So maybe they had one password which allowed access to the first 20 GB, but the rest is still encrypted?

superuser2 13y ago

See also: http://www.jsonline.com/news/crime/west-allis-man-indicted-on-federal-child-porn-charges-b9984158z1-221218841.html http://www.jsonline.com/news/crime/west-allis-man-indicted-o... It would appear that governments are able to somewhat efficiently bruteforce TrueCrypt volumes and access a little bit of data at a time. I couldn't get anyone interested in this article, but I would also like to know what's going on here. If a TrueCrypt volume can be broken for a small-time case of a child porn possession, that would seem to have dramatic ramifications for the security of pretty much everything in the world. Unless RSA is still solid and it's just TrueCrypt. Can any crypto experts comment?

rwmj 13y ago
They said on the news that he had the password written down on a piece of paper (which was also seized / found during the search). I don't think there's any mystery here.
- pbhjpbhj 13y ago
  That sounds like a line they'd use to try and cover up the abilities of GCHQ (or whoever) to access such filesystems. If they had the password then what prevented them from accessing the whole volume?
- superuser2 13y ago
  If they found the password, they would have all the drive. Not just part of it. Right?
lawnchair_larry 13y ago
That article provides no suggestion whatsoever that the government is able to efficiently bruteforce truecrypt. I think everyone can agree that if any part of the government had better-than-brute force capabilities for truecrypt, the FBI would absolutely not be allowed to disclose or make use of that capability in a child porn case. More likely explanations: Forensics recovered the password from an unencrypted volume, or he had a really dumb password, and he probably reused it somewhere.
venomsnake 13y ago
RSA is asymmetrical algorithm. They rely on mathematical problems being hard. TrueCrypt use symmetrical - AES Twofish and Serpent and you can even cascade them. RSA and AES have nothing in common. So a mathematical breakthrough in RSA will not help at all with making AES insecure.

lawnchair_larry 13y ago

The problem with assessing the statement is that it went through multiple people who don't have first hand knowledge of the actual incident, and who don't have a technical understanding of what they are even talking about. Details are subtle but they matter.

justincormack 13y ago

Apparently he had the password written down, and there were instructions and a key on the disk, according to various stories. Seems like Snowden gave them the key or something it seems odd.

deleted 13y ago

[deleted]

cnvogel 13y ago

If one believes the report of the NY Times, I'd doubt that hewould have left traces of files left on the computer they took with them, the article explicitly mentions Poitras (who Miranda alegedly had met in Berlin) wiping harddrives completely before crossing borders: http://www.nytimes.com/2013/08/18/magazine/laura-poitras-snowden.html http://www.nytimes.com/2013/08/18/magazine/laura-poitras-sno... Also, with TrueCrypt (or any other well-designed full disk encryption software) I'd not expect single files to be discovered, it should be either all or nothing.

JosephRedfern 13y ago

I don't know much about RSA/TrueCrypt... but surely a file ordered: A+B+C+D+E+F+G wouldn't be stored as enc(A)+enc(B)+enc(C)+enc(D)+enc(E)+enc(F)+enc(G). If they are able to access 20GB of the volume, what would stop them from accessing the other 40GB?

sp332 13y ago

Truecrypt allows "hidden volumes" to reside inside the same encrypted volume. So maybe they had one password which allowed access to the first 20 GB, but the rest is still encrypted?