9 ms·

Another update on the Truecrypt audit

173 points by tomrittervg 12y ago

tptacek 12y ago
More discussion: https://news.ycombinator.com/item?id=9069295 https://news.ycombinator.com/item?id=9069295
- diminoten 12y ago
  Can you explain this quote from you and your involvement in the TrueCrypt audit? "By encouraging people to rely on tools like Truecrypt, you are, in a very small but real way, endangering them." [0] It just seems like you supporting the audit (and therefore supporting TrueCrypt) is at direct odds with what you said an hour ago. [0] - https://news.ycombinator.com/item?id=9071126 https://news.ycombinator.com/item?id=9071126
  - click170 12y ago
    Though I'm no tptacek, I think the reasoning here is that even though TrueCrypt is undergoing an audit, it's not under active development and unfortunately due to the licensing, any patches produced by the community could be on uncertain footing legally.
    - diminoten 12y ago
      I would love for Thomas to write an article on his blog about the difference between thinking something is dangerous to support, and then supporting a security audit of that same thing.
      - Dylan16807 12y ago
        It's dangerous to encourage truecrypt to the exclusion of other options. It's dangerous to use truecrypt in inappropriate situations. At the same time it's good to make sure truecrypt is the best it can be at what it does, even if that category is fundamentally limited. To get more explicit, it's the difference between "using" truecrypt and "relying" on truecrypt. You want to give people an accurate picture of their options and the tradeoffs. "relying" on truecrypt is dangerous.
        tptacek 12y ago
        Yes. Exactly this. Also: your guess is as good as mine as to why this nuance was worth discussing.
        diminoten 12y ago
        This is just sensationalism. "<Popular product> shouldn't be relied on!" What he doesn't say is exactly what you just said, that it works for the majority of use cases. It all hinges on this liberal interpretation of the word "rely". "Top 10 things your cryptographer doesn't want you to know!" It's marketing, and it's annoying. TrueCrypt is just fine for the majority use case, and Thomas knows that, but that doesn't get attention. Saying bombastic things like, "Don't use TrueCrypt!" gets attention. So I gave him some attention. Hope that's what he wanted.
        Dylan16807 12y ago
        You're the one making a big deal out of a statement as simple as "use something better if possible", trying to turn it into a contradiction so he can be "wrong". Use cases where the security fails are a huge red flag. Mentioning red flags is not sensationalism.
        diminoten 12y ago
        That's not what he said, he said it's actively harmful to promote the use of TrueCrypt. That's a world of difference from "use something better if possible".
  - chimeracoder 12y ago
    It's pretty easy to explain - and in fact, you got your answer[0] > Block-level encryption is a terrible, terrible approach for many reasons (which 'tptacek has referenced a million times). However, Truecrypt is the best such implementation, and it's a required approach in certain cases. You should be doing crypto at the application/filesystem level; if you can't, use Truecrypt. This isn't contradictory advice. The only reason this even seems remotely contradictory is because you've taken Thomas's statement completely out of context (perhaps because it's nested about 50 lines in from the top-level comment that even provided the context in the first place). Alternatively, it's only contradictory if you take a black-and-white, all-or-nothing interpretation of what Thomas says... which is quite ironic, because one of his key criticisms of Truecrypt is that it is all-or-nothing, as stated in the very same post that you quote[1]. [0] https://news.ycombinator.com/item?id=9071492 https://news.ycombinator.com/item?id=9071492 [1] https://news.ycombinator.com/item?id=9071126 https://news.ycombinator.com/item?id=9071126
    - diminoten 12y ago
      Thomas changed his comments about 50 times between when we were replying to one another and now, so in all likelihood what I've written makes no sense in relation to what he's written anymore. That said, there is a very serious contradiction between supporting the audit of software, and thinking that the support of said software is actively harmful. If it's actively harmful, Thomas shouldn't support its use, period. He should either resign entirely from all activity related to TrueCrypt, or amend his comment to reflect what he actually thinks.
      - tptacek 12y ago
        edit: I wrote something unproductive here
        4oh9do 12y ago
        As a casual user, I would like to know how I am endangering users by encouraging them to use TrueCrypt? And what should I be encouraging them to use instead?
basic365 12y ago
This project will probably get outdated by windows 11 or 12, it will lose support and become legacy ... I don't see why people should spend money auditing it, instead of building maintainable alternatives
- abhididdigi 12y ago
  Do you have any source to say Truecrypt becomes outdated? The last I checked, it was working just fine in Windows 8. I don't think anything would be _drastically_ changing in Windows 11 and 12.
- plus 12y ago
  People have already spent the money to audit it, back before development was officially discontinued. What do you expect them to do with the money? Return it to the people who donated?
- nadams 12y ago
  This is extremely unlikely. Windows API doesn't change that drastically between versions. Which is why people don't have to recompile their programs for newer/different versions of Windows.
  - michaelt 12y ago
    Windows maintains good compatibility for userspace applications, but they don't guarantee driver compatibility. A Windows 95 program might run on Windows 7, but drivers for Windows 95 probably wouldn't! Truecrypt manages to create virtual disks that look a lot like regular disks, so I assume it does some kernel-level stuff to make that work.
- Someone1234 12y ago
  TrueCrypt was much more flexible than anything Windows has to offer. Bitlocker is great for enterprise-style encryption, in particular on machines with TPM chips. However many consumer machines do not include a TPM, even in 2015. TrueCrypt allowed you to encrypt individual drives, even offline drives, with no Bitlocker overhead. You also weren't required to decrypt them upon each boot like Windows' Bitlocker insists upon. Additionally TrueCrypt would also encrypt directories, USB drives, hidden volumes, various encryption algorithms, double encryption, and so on. Plus it was cross-platform friendly (or at least more so than BitLocker). What are we meant to use to move encrypted data from Linux to Windows now? 7Zip w/AES 256?
Canada 12y ago
I'm looking forward to the next report. One thing I noticed looking through the code is that the key generation on Windows mixes a CRC32 of a MOUSEHOOKSTRUCT. If you look at it, there isn't a huge amount of entropy in there... Some fields, such as the window handle, don't change between callbacks. Others, such as the hit test code are enums with limited possible values, and the way that most people move the mouse around will return the exact same value all the time. The difference in time between two different values is run through CRC32 a few times and then the whole thing is run through a real hash. Most users don't bother adding entropy from the keyboard. While I don't think any of this is a vulnerability, I think it could be better. [edit: I'm talking about Common/Random.c in 7.1a. And by better I'm suggesting additional sources of entropy be included in the process]
- tedunangst 12y ago
  It doesn't at least try CryptGenRandom?
  - Canada 12y ago
    You are right, it does use that if available. It grabs a bunch of other system state as well, depending on the situation.
ThinkBeat 12y ago
From Wikipedia: TrueCrypt is a discontinued source-available freeware utility used for on-the-fly encryption. It can create a virtual encrypted disk within a file or encrypt a partition or the entire storage device. Since TrueCrypt is dead, what is the purpose of auditing it? Is there an official team that is ready, willing and able to take over maintenance and development? If anything should be audited I would think it should be one of the forks. But the author makes the following comment on the other thread: ---------------------------------- Also: speaking in no "official" capacity whatsoever, I'd advise you to stay away from the forks of Truecrypt. Unless something new has come to light since last I looked, the licensing situation on the TC code is weird: http://lists.freedesktop.org/archives/distributions/2008-Oct.. http://lists.freedesktop.org/archives/distributions/2008-Oct.... ... which means there is a pretty strong disincentive for people with serious crypto and systems expertise to invest their time and energy building on it. You don't want to trust crypto platforms with built-in adverse selection problems. --------------------------- So the forks have issues and the main project is dead?? But we needz more money to audit it more? I am also unclear what the first expensive audit accomplished if it did not cover encryption. Sounds like having an inspection on a house that covers part of the roof and two rooms and nothing else like the foundation. Does anyone have a link to the original campaign to raise money?
- daxelrod 12y ago
  > Since TrueCrypt is dead, what is the purpose of auditing it? I asked that question, and received a response from tptacek here: https://news.ycombinator.com/item?id=9070420 https://news.ycombinator.com/item?id=9070420
- bhayden 12y ago
  It's worth noting, I believe the effort to audit TC began before they "shut down".
- joshvm 12y ago
  > Since TrueCrypt is dead, what is the purpose of auditing it? It makes sense to audit the common ancestor rather than a single one of the derivatives because you'll cover more bases. If TC is found to have a critical vulnerability then you'll know all forks have the problem. If one fork is found to be vulnerable then you'll need to figure out whether it's a TC vulnerability or some subtle dependency on the new code.
2f3opkvelf 12y ago
You can be proud, make 10000% more money that true crypt developer for several years working and now act like nothing happened. This audit was reasons why TT is offline
- juliob 12y ago
  Sorry, didn't understand that.
  - jszymborski 12y ago
    Think he was getting at a theory that the development of TrueCrypt was abandoned because of the audit, for some reason. Maybe for reasons of pride (questioning their integrity by looking for backdoors) or fear that something nefarious would be uncovered. The first is plausible, the second doesn't sound like the reaction an anonymous author would have. Most plausible reason the devs abandoned it imho is that they got bored.
godgod 12y ago
What's the point of Truecrypt when the NSA can backdoor your hard drive firmware? Kinda makes encrypting hard drive pointless. Why not work towards open source hard drive firmware that works across multiple vendors and that can be independently verified secure?

173 points by tomrittervg 12y ago

tptacek 12y ago

More discussion: https://news.ycombinator.com/item?id=9069295 https://news.ycombinator.com/item?id=9069295

diminoten 12y ago
Can you explain this quote from you and your involvement in the TrueCrypt audit? "By encouraging people to rely on tools like Truecrypt, you are, in a very small but real way, endangering them." [0] It just seems like you supporting the audit (and therefore supporting TrueCrypt) is at direct odds with what you said an hour ago. [0] - https://news.ycombinator.com/item?id=9071126 https://news.ycombinator.com/item?id=9071126
- click170 12y ago
  Though I'm no tptacek, I think the reasoning here is that even though TrueCrypt is undergoing an audit, it's not under active development and unfortunately due to the licensing, any patches produced by the community could be on uncertain footing legally.
  - diminoten 12y ago
    I would love for Thomas to write an article on his blog about the difference between thinking something is dangerous to support, and then supporting a security audit of that same thing.
    - Dylan16807 12y ago
      It's dangerous to encourage truecrypt to the exclusion of other options. It's dangerous to use truecrypt in inappropriate situations. At the same time it's good to make sure truecrypt is the best it can be at what it does, even if that category is fundamentally limited. To get more explicit, it's the difference between "using" truecrypt and "relying" on truecrypt. You want to give people an accurate picture of their options and the tradeoffs. "relying" on truecrypt is dangerous.
      - tptacek 12y ago
        Yes. Exactly this. Also: your guess is as good as mine as to why this nuance was worth discussing.
      - diminoten 12y ago
        This is just sensationalism. "<Popular product> shouldn't be relied on!" What he doesn't say is exactly what you just said, that it works for the majority of use cases. It all hinges on this liberal interpretation of the word "rely". "Top 10 things your cryptographer doesn't want you to know!" It's marketing, and it's annoying. TrueCrypt is just fine for the majority use case, and Thomas knows that, but that doesn't get attention. Saying bombastic things like, "Don't use TrueCrypt!" gets attention. So I gave him some attention. Hope that's what he wanted.
        Dylan16807 12y ago
        You're the one making a big deal out of a statement as simple as "use something better if possible", trying to turn it into a contradiction so he can be "wrong". Use cases where the security fails are a huge red flag. Mentioning red flags is not sensationalism.
        diminoten 12y ago
        That's not what he said, he said it's actively harmful to promote the use of TrueCrypt. That's a world of difference from "use something better if possible".
- chimeracoder 12y ago
  It's pretty easy to explain - and in fact, you got your answer[0] > Block-level encryption is a terrible, terrible approach for many reasons (which 'tptacek has referenced a million times). However, Truecrypt is the best such implementation, and it's a required approach in certain cases. You should be doing crypto at the application/filesystem level; if you can't, use Truecrypt. This isn't contradictory advice. The only reason this even seems remotely contradictory is because you've taken Thomas's statement completely out of context (perhaps because it's nested about 50 lines in from the top-level comment that even provided the context in the first place). Alternatively, it's only contradictory if you take a black-and-white, all-or-nothing interpretation of what Thomas says... which is quite ironic, because one of his key criticisms of Truecrypt is that it is all-or-nothing, as stated in the very same post that you quote[1]. [0] https://news.ycombinator.com/item?id=9071492 https://news.ycombinator.com/item?id=9071492 [1] https://news.ycombinator.com/item?id=9071126 https://news.ycombinator.com/item?id=9071126
  - diminoten 12y ago
    Thomas changed his comments about 50 times between when we were replying to one another and now, so in all likelihood what I've written makes no sense in relation to what he's written anymore. That said, there is a very serious contradiction between supporting the audit of software, and thinking that the support of said software is actively harmful. If it's actively harmful, Thomas shouldn't support its use, period. He should either resign entirely from all activity related to TrueCrypt, or amend his comment to reflect what he actually thinks.
    - tptacek 12y ago
      edit: I wrote something unproductive here
      - 4oh9do 12y ago
        As a casual user, I would like to know how I am endangering users by encouraging them to use TrueCrypt? And what should I be encouraging them to use instead?

basic365 12y ago

This project will probably get outdated by windows 11 or 12, it will lose support and become legacy ... I don't see why people should spend money auditing it, instead of building maintainable alternatives

abhididdigi 12y ago
Do you have any source to say Truecrypt becomes outdated? The last I checked, it was working just fine in Windows 8. I don't think anything would be _drastically_ changing in Windows 11 and 12.
plus 12y ago
People have already spent the money to audit it, back before development was officially discontinued. What do you expect them to do with the money? Return it to the people who donated?
nadams 12y ago
This is extremely unlikely. Windows API doesn't change that drastically between versions. Which is why people don't have to recompile their programs for newer/different versions of Windows.
- michaelt 12y ago
  Windows maintains good compatibility for userspace applications, but they don't guarantee driver compatibility. A Windows 95 program might run on Windows 7, but drivers for Windows 95 probably wouldn't! Truecrypt manages to create virtual disks that look a lot like regular disks, so I assume it does some kernel-level stuff to make that work.
Someone1234 12y ago
TrueCrypt was much more flexible than anything Windows has to offer. Bitlocker is great for enterprise-style encryption, in particular on machines with TPM chips. However many consumer machines do not include a TPM, even in 2015. TrueCrypt allowed you to encrypt individual drives, even offline drives, with no Bitlocker overhead. You also weren't required to decrypt them upon each boot like Windows' Bitlocker insists upon. Additionally TrueCrypt would also encrypt directories, USB drives, hidden volumes, various encryption algorithms, double encryption, and so on. Plus it was cross-platform friendly (or at least more so than BitLocker). What are we meant to use to move encrypted data from Linux to Windows now? 7Zip w/AES 256?

Canada 12y ago

I'm looking forward to the next report. One thing I noticed looking through the code is that the key generation on Windows mixes a CRC32 of a MOUSEHOOKSTRUCT. If you look at it, there isn't a huge amount of entropy in there... Some fields, such as the window handle, don't change between callbacks. Others, such as the hit test code are enums with limited possible values, and the way that most people move the mouse around will return the exact same value all the time. The difference in time between two different values is run through CRC32 a few times and then the whole thing is run through a real hash. Most users don't bother adding entropy from the keyboard. While I don't think any of this is a vulnerability, I think it could be better. [edit: I'm talking about Common/Random.c in 7.1a. And by better I'm suggesting additional sources of entropy be included in the process]

tedunangst 12y ago
It doesn't at least try CryptGenRandom?
- Canada 12y ago
  You are right, it does use that if available. It grabs a bunch of other system state as well, depending on the situation.

ThinkBeat 12y ago

From Wikipedia: TrueCrypt is a discontinued source-available freeware utility used for on-the-fly encryption. It can create a virtual encrypted disk within a file or encrypt a partition or the entire storage device. Since TrueCrypt is dead, what is the purpose of auditing it? Is there an official team that is ready, willing and able to take over maintenance and development? If anything should be audited I would think it should be one of the forks. But the author makes the following comment on the other thread: ---------------------------------- Also: speaking in no "official" capacity whatsoever, I'd advise you to stay away from the forks of Truecrypt. Unless something new has come to light since last I looked, the licensing situation on the TC code is weird: http://lists.freedesktop.org/archives/distributions/2008-Oct.. http://lists.freedesktop.org/archives/distributions/2008-Oct.... ... which means there is a pretty strong disincentive for people with serious crypto and systems expertise to invest their time and energy building on it. You don't want to trust crypto platforms with built-in adverse selection problems. --------------------------- So the forks have issues and the main project is dead?? But we needz more money to audit it more? I am also unclear what the first expensive audit accomplished if it did not cover encryption. Sounds like having an inspection on a house that covers part of the roof and two rooms and nothing else like the foundation. Does anyone have a link to the original campaign to raise money?

daxelrod 12y ago
> Since TrueCrypt is dead, what is the purpose of auditing it? I asked that question, and received a response from tptacek here: https://news.ycombinator.com/item?id=9070420 https://news.ycombinator.com/item?id=9070420
bhayden 12y ago
It's worth noting, I believe the effort to audit TC began before they "shut down".
joshvm 12y ago
> Since TrueCrypt is dead, what is the purpose of auditing it? It makes sense to audit the common ancestor rather than a single one of the derivatives because you'll cover more bases. If TC is found to have a critical vulnerability then you'll know all forks have the problem. If one fork is found to be vulnerable then you'll need to figure out whether it's a TC vulnerability or some subtle dependency on the new code.

2f3opkvelf 12y ago

You can be proud, make 10000% more money that true crypt developer for several years working and now act like nothing happened. This audit was reasons why TT is offline

juliob 12y ago
Sorry, didn't understand that.
- jszymborski 12y ago
  Think he was getting at a theory that the development of TrueCrypt was abandoned because of the audit, for some reason. Maybe for reasons of pride (questioning their integrity by looking for backdoors) or fear that something nefarious would be uncovered. The first is plausible, the second doesn't sound like the reaction an anonymous author would have. Most plausible reason the devs abandoned it imho is that they got bored.

godgod 12y ago

What's the point of Truecrypt when the NSA can backdoor your hard drive firmware? Kinda makes encrypting hard drive pointless. Why not work towards open source hard drive firmware that works across multiple vendors and that can be independently verified secure?