13 ms·

Explained for a layperson: should i be using TrueCrypt, or is LUKS okay? Anyone here use TrueCrypt for whatever reason?

by toothbrush 12y ago

Quiark 12y ago
The benefit of TrueCrypt over LUKS is that it's portable to Windows and Mac.
- nbaksalyar 12y ago
  And it seems that LUKS supports full disk encryption only, while TrueCrypt allows to use encrypted containers (i.e. single files).
  - 0x0 12y ago
    Surely you can use LUKS on a loopback device backed by a single file?
    - krylon 12y ago
      I did so before moving to TrueCrypt. Mounting and dismounting was a bit convoluted compared to TrueCrypt (or encfs), I remember I wrote a Python script to make it a little more convenient. But it did work fine about five years ago, and I do not think the situation has become worse.
      - ryan-c 12y ago
        From http://manpages.ubuntu.com/manpages/trusty/man5/crypttab.5.html http://manpages.ubuntu.com/manpages/trusty/man5/crypttab.5.h... The second field, source device, describes either the block special device or file that contains the encrypted data. Instead of giving the source device explicitly, the UUID is supported as well, using UUID=<luks_uuid>. That covers the init scripts, and it looks like recent versions of cryptsetup will "do the right thing" if pointed at a file rather than a block device.
  - ryan-c 12y ago
    LUKS supports encryption of block devices. Linux has robust support for using regular files as block devices via the loopback driver, so you can have a file as an encrypted container just fine.
sdevlin 12y ago
Report coauthor here. No significant issues were found in either phase of the TrueCrypt audit. If you're using it today (or have used it in the past), I don't think you have anything to worry about. But it is an unmaintained piece of software, and for that reason I would migrate away from it. If I were setting up a new laptop today, I wouldn't consider installing it. If I had an existing laptop using it, I would think about transitioning when I had some spare time. Not a hair-on-fire problem, though.
- Lawtonfogle 12y ago
  All else being equal it would make sense to move. But all else isn't equal and having an audit and knowing the programmer knew their stuff enough to pass the audit (especially since this is in the crypto field) seems to be a huge benefit that other projects can't match right now.
  - tptacek 12y ago
    BitLocker and Filevault were almost certainly reviewed more carefully than Truecrypt was (I didn't participate in either audit, but can confirm that both of those companies allocate significant resources to third-party audits).
    - thesimon 12y ago
      Yeah, better trust US companies who are subject to NSA, which has been proven to require no backdoors in software /s
      - sdevlin 12y ago
        If those companies wanted to subvert your TrueCrypt installation, they would have an easy time of it.
        mafribe 12y ago
        Could you sketch how, so we can think about countermeasures?
dmix 12y ago
Tomb is better for this purpose than LUKS on Linux machines https://www.dyne.org/software/tomb/ https://www.dyne.org/software/tomb/ More of a direct competitor to Truecrypt.

Explained for a layperson: should i be using TrueCrypt, or is LUKS okay? Anyone here use TrueCrypt for whatever reason?

Quiark 12y ago

The benefit of TrueCrypt over LUKS is that it's portable to Windows and Mac.

nbaksalyar 12y ago
And it seems that LUKS supports full disk encryption only, while TrueCrypt allows to use encrypted containers (i.e. single files).
- 0x0 12y ago
  Surely you can use LUKS on a loopback device backed by a single file?
  - krylon 12y ago
    I did so before moving to TrueCrypt. Mounting and dismounting was a bit convoluted compared to TrueCrypt (or encfs), I remember I wrote a Python script to make it a little more convenient. But it did work fine about five years ago, and I do not think the situation has become worse.
    - ryan-c 12y ago
      From http://manpages.ubuntu.com/manpages/trusty/man5/crypttab.5.html http://manpages.ubuntu.com/manpages/trusty/man5/crypttab.5.h... The second field, source device, describes either the block special device or file that contains the encrypted data. Instead of giving the source device explicitly, the UUID is supported as well, using UUID=<luks_uuid>. That covers the init scripts, and it looks like recent versions of cryptsetup will "do the right thing" if pointed at a file rather than a block device.
- ryan-c 12y ago
  LUKS supports encryption of block devices. Linux has robust support for using regular files as block devices via the loopback driver, so you can have a file as an encrypted container just fine.

sdevlin 12y ago

Report coauthor here. No significant issues were found in either phase of the TrueCrypt audit. If you're using it today (or have used it in the past), I don't think you have anything to worry about. But it is an unmaintained piece of software, and for that reason I would migrate away from it. If I were setting up a new laptop today, I wouldn't consider installing it. If I had an existing laptop using it, I would think about transitioning when I had some spare time. Not a hair-on-fire problem, though.

Lawtonfogle 12y ago
All else being equal it would make sense to move. But all else isn't equal and having an audit and knowing the programmer knew their stuff enough to pass the audit (especially since this is in the crypto field) seems to be a huge benefit that other projects can't match right now.
- tptacek 12y ago
  BitLocker and Filevault were almost certainly reviewed more carefully than Truecrypt was (I didn't participate in either audit, but can confirm that both of those companies allocate significant resources to third-party audits).
  - thesimon 12y ago
    Yeah, better trust US companies who are subject to NSA, which has been proven to require no backdoors in software /s
    - sdevlin 12y ago
      If those companies wanted to subvert your TrueCrypt installation, they would have an easy time of it.
      - mafribe 12y ago
        Could you sketch how, so we can think about countermeasures?

dmix 12y ago

Tomb is better for this purpose than LUKS on Linux machines https://www.dyne.org/software/tomb/ https://www.dyne.org/software/tomb/ More of a direct competitor to Truecrypt.