Slashdot Mirror

http://www.truecrypt.org/docs/?s=compliance-with-standards

  TrueCrypt complies with the following standards, specifications, and recommendations:

        * PKCS #5 v2.0 [7]

        * FIPS 197 [3]

        * FIPS 198 [22]

        * FIPS 180-2 [14]

        * ISO/IEC 10118-3:2004 [21]

Protection of Hidden Volumes Against Damage

So basically you have to provide both the key for the outer volume and the key for the hidden volume to prevent damage to the hidden volume. Essentially it is trivially easy to damage the hidden volume. That's not the page I was looking for but it essentially talks about the same thing. I wasn't aware of the 2nd-key trick to prevent damage though. That helps but I can easily see that being forgotten; I'm sure I'd forget it if I used the hidden partition.

But if your backups are unencrypted then what is the point of encrypting the primary operating drive?

From their FAQ:

Q: I forgot my password - is there any way to recover the files from my TrueCrypt volume?

A: TrueCrypt does not contain any mechanism or facility that would allow partial or complete recovery of your encrypted data without knowing the correct password or the key used to encrypt the data. The only way to recover your files is to try to "crack" the password or the key, but it could take thousands or millions of years depending on the length and quality of the password/keyfiles, on software/hardware efficiency, and other factors.

Only volume (file) encryption is supported on Linux.
Not full system encryption, that is only available for MS Windows.

Only volume (file) encryption is supported on Linux.
Not full system encryption, that is only available for MS Windows.

FYI, http://www.truecrypt.org/downloads.php links to http://truecrypt.sourceforge.net/downloads/TrueCrypt%20Setup%205.0.exe.

And I cant get the PGP file. http://www.truecrypt.org/downloads/TrueCrypt%205.0%20Source.tar.gz.sig

http://www.truecrypt.org/downloads/transient/9b6d4c43d4/TrueCrypt%205.0%20Source.zip Forbidden You don't have permission to access /downloads/transient/9b6d4c43d4/TrueCrypt 5.0 Source.zip on this server. Apache/1.3.34 Server at www.truecrypt.org Port 80 I cannot get the source. The NSA has removed it.

If you'd take a moment and actually LOOK at their Sourceforge entry, you'd not have posted this. Here's what it says there:

IMPORTANT: Official TrueCrypt distribution packages can be downloaded only from www.truecrypt.org (above, select 'Project' > 'Web Site')

So - no Truecrypt 5 until http://www.truecrypt.org/ is back up. Sit tight folks.

http://superb-west.dl.sourceforge.net/sourceforge/truecrypt/IMPORTANT--Official_TrueCrypt_distribution_packages_can_be_downloaded_only_from_www.truecrypt.org.html

As of November 2, 2005, all official TrueCrypt distribution packages can be downloaded only at:

http://www.truecrypt.org/downloads.php

SourceForge.net mirror servers are no longer used. For more information, visit www.truecrypt.org

http://sourceforge.net/projects/truecrypt/

Press release here.

We are pleased to announce that TrueCrypt 5.0 has been released. Among the new features are the ability to encrypt a system partition or entire system drive (i.e. a drive where Windows is installed) with pre-boot authentication, pipelined operations increasing read/write speed by up to 100%, Mac OS X version, graphical interface for the Linux version, XTS mode, SHA-512, and more.

After four years of development, during which millions of people downloaded a copy of TrueCrypt, it is the only open-source disk encryption software that runs on Windows, Mac OS X, and Linux. The newly implemented ability to encrypt system partitions and system drives provides the highest level of security and privacy, as all files, including any temporary files that Windows and applications create on system drives (typically, without the user's knowledge or consent), swap files, etc., are permanently encrypted. Large amounts of potentially sensitive data that Windows records, such as the names and locations of files opened by the user, applications that the user runs, etc., are always permanently encrypted as well. For more information, please see http://www.truecrypt.org/docs/?s=version-history

The only thing I can say, is I've started some major "learning" about encryption and various other personal privacy applications.

So far, what I've found and like are:
TrueCrypt - "On-The-Fly" Disk/Storage Encryption. Actually, I've been using this for 24 hours and love it. I've also seen great reviews of this, and some of its very interesting features, such as plausible deniability. Oh, and its Free Open Source Software. Available for Windows 2K/2K3/XP/Vista, Linux, and soon MacOS (v5.0, due in Jan 08)
KeePass - Encrypted Password Storage Database. I've been using this for years, and love it. Also good reviews. If you wish to try it, there are two versions, v1.x and v2.x. v1.x (1.10 being current) is the original independent version. Can be run standalone, no system requirements (.Net or the like). Can be run from a USB Key. v2.x (2.04 being current) is a total rewrite of the application based on the .Net libraries and are required. This version is ALPHA quality and does not yet meet the current functionality of the 1.x branch. This was started due to the fact of people requesting features that would require significant rewrites to implement. Also FOSS. Available for Windows 98/98SE/ME/NT/2K/XP/2K3/Vista 32 and 64 bit. Third party ports also available for PocketPC, Linux, MacOSX, J2ME, Blackberry, PalmOS.
Gnu Privacy Guard - An open source PGP implementation. I use a port of this, GPG for Windows. It seems a bit clunky, and am actively looking for something to replace it so suggest away if you do know something better. I will say though that it does work as advertised, and its FOSS. GPG is distributed mainly as source code I believe, where as G4W is as binaries.

People have looked at some of us who use PGP/GPG, and other encryption/digital signatures for a few years with the look of "why do I need that, I have nothing to hide." I keep waiting for people to finally wake up and realize that the concept of "inherent privacy" (meaning anything not actively publicly published is not publicly known) is gone. We have entered the age of "explicit privacy." If you want something to be private, you must make explicitly so, especially on your computer, with these recent news articles of laptops being fair searching territories at Customs, or the reports that the NSA has feeds from AT&Ts offices to intercept everything.

http://truecrypt.org/ and similar tools may be of use. Not only can you protect an arbitrary volume with tc, you can hide another container inside it in a truly undetectable way.

Why waste good drives?

Create a full device Truecrypt http://www.truecrypt.org/ volume on each, using the same long (20 chars of so) password for each that you will always remember, and redundantly backup stuff on them. Then put them in a drawer. The Truecrypt volume will completely fill the drive, every sector, so you've wiped the old data. And now you've got backups that no-one else can access, for free.

Go now and download TrueCrypt. It is free, open source and runs on Linux and MS Windows, and this month version 5.0 will run on OS X.

I use it at work, and on my Win and Lin boxes at home. As soon as 5.0 comes out, I will be all set. ;-)

Well, if you used a hidden volume via TrueCrypt would they even know you had any encrypted data :)

I thought TrueCrypt had this capability, at least on encrypted "containers".

Basically, if you put in password1, you get one set of data decrypted(and shown). If you put in password2, you get a completely different set of data.

Is there now a place for a program that decrypts data in two ways?

Truecrypt provides encryption, hidden volume-in-a-volume and plausible deniability. Oh, it's free and win/nux multiplatform, too.

... there are effective ways to protect your own privacy http://www.truecrypt.org/

I an app developer, not a driver developer, but I have seen a few programs, like TrueCrypt fake-out the Windows Driver Architecture into using a driver that isn't associated with actual hardware.

I don't see any reason that this won't work for Video and Sound drivers (until MSFT tries to shove trusted computing down our throats). I have been considering researching the feasibility of/writing a [OSS?] driver that would take the output and encode it directly to disk. This bypasses the need to actually target the hardware itself.

The answer is encrypted virtual drives using TrueCrypt or even possibly AxCrypt, which can handle individual file encryption and allow for password entry every time you need to open the file.

As posted previously, this is already implemented: http://www.truecrypt.org/docs/hidden-volume.php

Imagine being able to download an open-source implementation of said cryptosystem from http://www.truecrypt.org/...

(Seriously, you must be new here. Half the comments on any encryption-and-law-related post are links to TrueCrypt.)

Systems like this already exist. Take a look at http://www.truecrypt.org/docs/?s=plausible-deniability. It will allow you to place a second encrypted volume inside a primary one. Then, if necessary, you can turn over the primary password and everything in the second volume is still hidden. Whats more, it is impossible to tell a second encrypted volume even exists.

If the passphrase is considered keys to a safe, and you are therefore likely to be forced to divulge it, then you can avoid trouble by using an encryption system, like TrueCrypt, that supports plausible deniability. Inside the encrypted volume, blank space is always filled with random data, which can also be another nested encrypted volume. Without the correct passphrase, nobody can prove that the random bits are anything more than random bits.

On my current setup with Ubuntu 7.10, it is fairly easy to set up TrueCrypt with hidden volumes.

                  http://www.truecrypt.org/docs/hidden-volume.php

Without any proof of the existence of a hidden volume, there is no way for the government to compel discovery. I don't bother using a hidden volume myself because I'm not concerned with plausible deniability. But without being able to tell me apart from the users that do, a judge won't be able to do anything for the government.

The technological revolution has happened far faster than the ability of humans to adjust.

TrueCrypt is free encryption for both Windows and Linux. It works extremely well, in my experience.

truecrypt.

sigh

It seems to me that unless they need or want whole disk encryption of the boot partition, which still doesn't answer the unencrypted backup tape question, that TrueCrypt would have been perfect for them.

Your Product (and any associated materials, e.g., the documentation, the content of the official web site of Your Product, etc.) must not present any Internet address containing the domain name truecrypt.org (or any domain name that forwards to the domain name truecrypt.org) in a manner that suggests that it is where information about Your Product may be obtained or where bugs found in Your Product may be reported or where support for Your Product may be available or otherwise attempt to indicate that the domain name truecrypt.org is associated with Your Product.

Your Product (and any associated materials, e.g., the documentation, the content of the official web site of Your Product, etc.) must not present any Internet address containing the domain name truecrypt.org (or any domain name that forwards to the domain name truecrypt.org) in a manner that suggests that it is where information about Your Product may be obtained or where bugs found in Your Product may be reported or where support for Your Product may be available or otherwise attempt to indicate that the domain name truecrypt.org is associated with Your Product.

Your Product (and any associated materials, e.g., the documentation, the content of the official web site of Your Product, etc.) must not present any Internet address containing the domain name truecrypt.org (or any domain name that forwards to the domain name truecrypt.org) in a manner that suggests that it is where information about Your Product may be obtained or where bugs found in Your Product may be reported or where support for Your Product may be available or otherwise attempt to indicate that the domain name truecrypt.org is associated with Your Product.

Except Truecrypt ain't GPL... Otherwhise I'd be able to get it with an apt-get. I can't...

I do use Truecrypt on Windows, but I know it's limited to mainly Windows. The Linux support is nice, but it doesn't even have all features.

For the lazy :)

Looks pretty cool, but I am guessing that it couldn't be used in conjunction with gDisk. Also, "only" Windows and Linux are supported.

There is no need to decrypt the entire file to be able to use it. You can design a file system so that only the blocks needed are decrypted and you can basically use the file system just like a live file system with the crypto layer keeping it all very much transparent. Using Google's online file storage in such a way that you could mount it like a drive, then sticking a truecrypt container in it would give the desired effect of my previous post.

I do, but home users aren't their primary target I'd say. I think the BSA would bend more for home users but businesses make a living off software so they are considered more of a target. Years ago it was hard to track software licenses but these days its not hard too if you really want to. However I do believe companies deserve a chance to mend their ways and you'll probably find the 90k they were "fined" was equal to the software they used without a license. I could be wrong but I think you'll find BSA will only target large vendor software company products.

As a side note I use True Crypt on my USB drives - its free, cross platform, and is even more flexible than PGP Disk (which I used prior until my license expiring). http://www.truecrypt.org/.

The law states that businesses, government (except The Home Office of course) have to take reasonable precautions. Whether the laptop the data is on is lost or it's stolen doesn't matter. It's the lack of precautions which matter. Particularly when it's as simple as:

http://www.truecrypt.org/

I was recently looking into secure communications and revisited hushmail, discovered it was compromised (this story isn't new). I believe there is no good encryption solution available that doesn't involve both the sender and receiver running the same software.

Once you make that compromise the solutions multiply. For windows I really like truecrypt for file/disk encryption and firegpg with gnugp to do web based email encryption.

I don't know what the documentation looked like when you were evaluating, but the linux section of http://www.truecrypt.org/docs/ looks like it has a man page for a linux executable, and doesn't mention MS Windows.

What you, and I quote, "seem to forget" is that the tool discussed in this thread does deal with the case you're presented. Through the use of a second 'hidden' encrypted volume, analogous to a false bottom in a briefcase, when investigators locate encryption software as well as a partition with lots of random data on it and force you to provide them the encryption key, you only provide them the 'outer' or 'public encrypted' volume. That volume is then decrypted, and unfortunately for investigators or other inquiring 3rd parties, it is impossible to tell whether a false bottom encrypted volume exists within the first encrypted volume or not without being provided the password. For more reading, educate yourself at http://www.truecrypt.org/docs/?s=plausible-deniability and http://www.truecrypt.org/hiddenvolume.php

What you, and I quote, "seem to forget" is that the tool discussed in this thread does deal with the case you're presented. Through the use of a second 'hidden' encrypted volume, analogous to a false bottom in a briefcase, when investigators locate encryption software as well as a partition with lots of random data on it and force you to provide them the encryption key, you only provide them the 'outer' or 'public encrypted' volume. That volume is then decrypted, and unfortunately for investigators or other inquiring 3rd parties, it is impossible to tell whether a false bottom encrypted volume exists within the first encrypted volume or not without being provided the password. For more reading, educate yourself at http://www.truecrypt.org/docs/?s=plausible-deniability and http://www.truecrypt.org/hiddenvolume.php

Correct- TrueCrypt has support for hidden and public volumes, both of which can use entirely seperate keys/keyfiles.

TrueCrypt allows hidden volumes, indistinguishable from one volume. The file size is constant.

TrueCrypt works very, very well. I use it with just one volume to protect passwords and other files.

When you don't want to encrypt a volume, but just a file, Gnu Privacy Guard is best.

TrueCrypt allows hidden volumes, indistinguishable from one volume. The file size is constant.

TrueCrypt works very, very well. I use it with just one volume to protect passwords and other files.

When you don't want to encrypt a volume, but just a file, Gnu Privacy Guard is best.

Yeah. Truecrypt does this.

http://www.truecrypt.org/hiddenvolume.php

Truecrypt is pretty nifty all around.

That won't help you much, as anyone with half a brain would be sure to make an image of the data in question prior to touching the file itself, so they'll still have a copy of it.

What you really want is Plausible Deniability. Which is something that Truecrypt among others provides.

In the event of real coercive duress, you give them a key that *oops* results in them seeing your resume and a few other private, yet otherwise innocuous, files.

That won't help you much, as anyone with half a brain would be sure to make an image of the data in question prior to touching the file itself, so they'll still have a copy of it.

What you really want is Plausible Deniability. Which is something that Truecrypt among others provides.

In the event of real coercive duress, you give them a key that *oops* results in them seeing your resume and a few other private, yet otherwise innocuous, files.

A Better solution is plausible deniability.

One password gives your uber-secret-plans-for-world-conquest, the other password gives a few hundred meg of soft porn (or whatever).

That way, you appear to not be resisting their demands.