Slashdot Mirror
TrueCrypt 5.0 Released, Now Encrypts Entire Drive
A funny little man writes "The popular open source privacy tool, TrueCrypt, has just received a major update. The most exciting new feature provides the ability to encrypt an entire drive, prompting the user for a password during boot up; this makes TrueCrypt the perfect tool for non-technical laptop users (the kind who are likely to lose all of that sensitive customer data). The Linux version receives a GUI and independence from the kernel internals, and a Mac version is at last available too."
That removes the last excuse people have for not encrypting everything..."It is too complicated". Total encryption with a password at bootup...couldn't be simpler.
It's not by Microsoft. Plus they don't have much data left to lose.
It is also, of course, impossible that it encrypts the *entire* disk. It may encrypt all the partitions your running system uses, but unless your BIOS has encryption support (which it doesn't), you can't have an encrypted boot partition.
Step 1: Post on Slashdot
Step 2: ???
Step 3: Profit!
But this is slashdot. A slashdoter who didn't build his own computer is like a Jedi who didn't build his own lightsaber!
They have to option to convert boot drives to encrypted drives... even while the system is running.
Thats nice.
But how about converting non-boot drives?
Doesnt seem to be possible.
Not everybody starts with a blank sheet, or has double the needed capacity to empty first one HD and then another...
HI O WISE PRINCE. WHT TOOK U SO DAM LONG?
Too Bad that for some reasons they refuse to upload any files on the sourceforge server. There is only a "the files are only on truecrypt.org.html" available.
http://sourceforge.net/projects/truecrypt/
Press release here.
We are pleased to announce that TrueCrypt 5.0 has been released. Among the new features are the ability to encrypt a system partition or entire system drive (i.e. a drive where Windows is installed) with pre-boot authentication, pipelined operations increasing read/write speed by up to 100%, Mac OS X version, graphical interface for the Linux version, XTS mode, SHA-512, and more.
After four years of development, during which millions of people downloaded a copy of TrueCrypt, it is the only open-source disk encryption software that runs on Windows, Mac OS X, and Linux. The newly implemented ability to encrypt system partitions and system drives provides the highest level of security and privacy, as all files, including any temporary files that Windows and applications create on system drives (typically, without the user's knowledge or consent), swap files, etc., are permanently encrypted. Large amounts of potentially sensitive data that Windows records, such as the names and locations of files opened by the user, applications that the user runs, etc., are always permanently encrypted as well. For more information, please see http://www.truecrypt.org/docs/?s=version-history
I almost never turn off my laptop, I just close the lid. Will it ask me for a password when it wakes up again?
You Fail It.
But this is slashdot. A slashdoter who didn't build his own computer is like a Jedi who didn't build his own lightsaber!
Here it is
Thanks, but the packages are not available to download from SourceForge. "IMPORTANT: Official TrueCrypt distribution packages can be downloaded only from www.truecrypt.org (above, select 'Project' > 'Web Site') Notes"
One CPU cycle wasted on digital restrictions management is ONE TOO MANY.
Actually, I've been having trouble accessing the site all day.
I've been looking forward to the Linux GUI since I read about it, checking back, checking back etc.
Then today, suddenly the entire site is virtually inaccessible.
On the actual release, I think it is going to be good. After all, we see a new MacOS version, a Linux GUI and a few other nice little tools which most people might not even notice.
On the actual software, I love TrueCrypt, I use it both in Windows (where it, simply, is so easy to use), and in Linux (command-line, mehs all around, plus you have to go and delete history if you don't want to save the fact that your using it (or perhaps the fact that a specific file/partition is a container)).
The hidden-partition feature is the bees knees, especially for those extra secret documents, just hide them behind some porn, financial data or something else which you access and make changes to regularly (to hide if you are making changes to the hidden volume).
The ability to back-up headers makes this software great for businesses or governments (can restore a password if a user loses it), and this new encrypt the entire system thing, simply swell (though it doesn't work on Linux/MacOS I don't think).
Anyway, as always, check out the Wikipedia article for more info. http://en.wikipedia.org/wiki/TrueCrypt
I wank in the shower.
You can ONLY download from truecrypt.org. According to the sourceforge page anyway...
Acid House saves Souls
IMPORTANT--Official_TrueCrypt_distribution_packages_can_be_downloaded_only_from_www.truecrypt.org
I've been waiting for this release. I know that real men use the command line for each and everything including brewing their morning coffee, but I was really looking forward to the graphical user interface. :) Of course, thanks to Slashdot now the site (which has been dead slow all day) has now been blasted out of orbit...
Ah well, maybe the storm will be over till I'm home.
Yes, they can recover key and encryption algorithms from the unencrypted boot sector. But if they can crack you simply by knowing the unencryption program, you're boned anyways. What they *can't* recover, assuming that your encryption vendor hasn't screwed up, is your key. And without that, they can't read your encrypted partitions. If they've done it right, it's secure. Somebody in possession of your laptop but without your passphrase cannot read the disk, no matter what he does, except for the boot partition, and there won't be any useful data there. I don't use Truecrypt and haven't researched them, so I can't guarantee that they did it right (look at WEP, where they managed to botch the encryption for a major standard, resulting in it having to be replaced by WPA). I believe every laptop should be "whole disk" encrypted--it's just too easy for a laptop to disappear. I run debian on my laptop, so I used cryptmount to encrypt my disk. If you're not encrypting your laptop's disk, you definitely should be. A brief glance over some recent news stories should tell you why.
It is also, of course, impossible that it encrypts the *entire* disk. It may encrypt all the partitions your running system uses, but unless your BIOS has encryption support (which it doesn't), you can't have an encrypted boot partition.
Your concept of impossible is, of course, a little bit flawed, for I have at least 5 *entire* disks encrypted in this single box I am writing on. And some of them has no partitions, just a filesystem over raw disk.
There you are, staring at me again.
Hi, I read the site yesterday (from Firehose), and I think I can say one thing or two.
TrueCrypt does a good job of encryption, it's not a trivial level. It uses strong algorithms, and you can choose from 5 or 6 different algorithms. It doesn't store your password anywhere in the disk, when you type the password, it tries to decrypt the header, and if it makes sense (I guess if checksums match) then it knows it's the right password and it goes on, otherwise not. It uses basically the XEX (almost sure that's the name... I don't really know what it is, this is what I remember from the site) schema, but XEX uses only one key for two purposes, and TrueCrypt uses two different keys for these two purposes.
The whole-disk encryption (the correct term is partition encryption) seems to work well, at least from the documentation, I didn't try it (yet). It includes a boot sector that does the part of asking the password during boot and decrypting the partition. The boot sector is obviously encrypted, and I suppose it also stores some unencrypted data to implement the boot code (I don't believe it can be done in 512 bytes only), but after you boot the OS, everything it sees is encrypted, so it will protect even temporary files or logs created by the OS on that drive. Even if it doesn't encrypt 100% of the data (boot sector, boot code), it encrypts everything that you should encrypt. What it doesn't encrypt is not secret in any way.
I tried previous versions and I liked it, it is really a great product, and if 5.0 does everything they say it does, I guess it's really worth it. Whole-disk encryption is no longer missing from this excellent software, many businesses need it for laptops (just see how many information theft happened last year due to lost laptops). I believe TrueCrypt is going mainstream now.
As someone who has never used a full-drive encrypted, how does this impact hard drive access? Will reads/writes be noticeably slower (assuming a relatively new drive)? Will this affect utilities such as a defragmenter or disk checker? How much slower will boot up be? What about memory or CPU usage?
I am all for more security. But, if it slows my laptop down to the point of un-usability....
If at first you don't succeed, call it version 1.0.
I will just wait until you pesky North Americans are in bed and download in the morning UK time, ha ha. Wait, no, everyone forget I said that! Aww, now you all will try then.
Of course you can. You just can't have an encrypted MBR... unless you boot from a floppy or a USB drive you keep on your person, or something like that. Note that bios limitations can also be circumvented with linuxbios
http://www.truecrypt.org/downloads/transient/9b6d4c43d4/TrueCrypt%205.0%20Source.zip Forbidden You don't have permission to access /downloads/transient/9b6d4c43d4/TrueCrypt 5.0 Source.zip on this server.
Apache/1.3.34 Server at www.truecrypt.org Port 80
I cannot get the source. The NSA has removed it.
I would like to encrypt my entire laptop drive, but I'm not going through all the trouble if its just another easy layer to break through. Any Truecrypt experts out there?
I am not a TrueCrypt expert, but I follow the discoveries of the crypto community. It seems TrueCrypt is highly respected. While it cannot defeat a (hardare in this case) keylogger, the crypto used seems to be strong crypto implemented according to current standards. Not a snake-oil product with home-rolled ciphers or "passwordless" security or such nonsense. At the moment, nobody admits being able to breaking it and I am not aware of instances that indicate it has been broken. And, other than many other products, it is widely used. Personally I would say it is on a level with PGP/GnuPG/dm-crypt/LUKS with regard to security level offered.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
5.0
February 5, 2008
New features:
*
Ability to encrypt a system partition/drive (i.e. a partition/drive where Windows is installed) with pre-boot authentication (anyone who wants to gain access and use the system, read and write files, etc., needs to enter the correct password each time before the system starts). For more information, see the chapter System Encryption in the documentation. (Windows Vista/XP/2003)
*
Pipelined operations increasing read/write speed by up to 100% (Windows)
*
Mac OS X version
*
Graphical user interface for the Linux version of TrueCrypt
*
XTS mode of operation, which was designed by Phillip Rogaway in 2003 and which was recently approved as the IEEE 1619 standard for cryptographic protection of data on block-oriented storage devices. XTS is faster and more secure than LRW mode (for more information on XTS mode, see the section Modes of Operation in the documentation).
Note: New volumes created by this version of TrueCrypt can be encrypted only in XTS mode. However, volumes created by previous versions of TrueCrypt can still be mounted using this version of TrueCrypt.
*
SHA-512 hash algorithm (replacing SHA-1, which is no longer available when creating new volumes).
Note: To re-encrypt the header of an existing volume with a header key derived using HMAC-SHA-512 (PRF), select 'Volumes' > 'Set Header Key Derivation Algorithm'.
Improvements, bug fixes, and security enhancements:
*
The Linux version of TrueCrypt has been redesigned so that it will no longer be affected by changes to the Linux kernel (kernel upgrades/updates).
* Many other minor improvements, bug fixes, and security enhancements. (Windows and Linux)
If you are using an older version of TrueCrypt, it is strongly recommended that you upgrade to this version.
4.3a.......
==============
System Encryption
TrueCrypt can on-the-fly encrypt a system partition or entire system drive, i.e. a partition or drive where Windows is installed and from which it boots (a TrueCrypt-encrypted system drive may also contain non-system partitions, which are encrypted as well).
System encryption provides the highest level of security and privacy, because all files, including any temporary files that Windows and applications create on the system partition (typically, without your knowledge or consent), swap files, etc., are permanently encrypted. Windows also records large amounts of potentially sensitive data, such as the names and locations of files you open, applications you run, etc. All such log files and registry entries are always permanently encrypted as well.
System encryption involves pre-boot authentication, which means that anyone who wants to gain access and use the encrypted system, read and write files stored on the system drive, etc., will need to enter the correct password each time before Windows boots (starts). Pre-boot authentication is handled by the TrueCrypt Boot Loader, which resides in the first cylinder of the boot drive.
Note that TrueCrypt can encrypt an existing unencrypted system partition/drive in-place while the operating system is running (while the system is being encrypted, you can use your computer as usual with
Any word on 64bit binaries for Linux? I've compiled the Non-gui version without issue before, but with a gui, things get more complicated. GTK/KDE? Which libraries? etc etc etc etc etc
Sig
Appended to the end of comments you post. 120 chars
Are they planning to submit their system for FIPS 140-2? The US OMB decreed that most laptops must be encrypted with full-disk FIPS 140-2-compliant encryption, but the only certified tools for this exist for Windoze. The algorithms used are fine, but this stamp of approval would be very useful for federal Linux and Mac users!
Oh, I forgot to mention. According to their website, TrueCrypt can encrypt the boot partition even after the OS is installed, even with Windows.
Basically, you install it, then you ask it to encrypt the whole disk. It will install the boot code to ask the password and decrypt the partition before loading the OS, and then it will start encrypting your partition in the background, you may continue using the OS. You may even reboot the machine, it will boot correctly and continue encrypting from where it stopped. If it really works as they say it does, this version is indeed amazing.
Being in the US, I have become so paranoid now that I encrypt everything with TrueCrypt. Whether it's MP3's, DVDs or pr0n or just simply my web browser cache, it all goes into the encrypted file. Long hard password and keyfiles, and then I also use hidden volumes.
And one big big big reason I use encryption: Usenet. I often use NewsBin to indiscriminately download all the binaries in a given group. I think this is very dangerous. And many times you get some very illegal junk you just don't want lying around -- but I can't get to it for several days to manually filter through it. ISPs get the benefit of being an ISP and not having to filter their caches for content; I do not get that same benefit. If I get caught with something I shouldn't have, it's jail time.
So if it comes up that I had inadvertently downloaded some kiddie pr0n through Usenet newsgroup (which is often mixed in with legitimate stuff), and my machine gets searched, I want some protection. And both: the things I downloaded and the things I have deleted simply CAN NOT be found.
"They said I probly shouldn't fly with just one eye," "I am Bender. Please insert girder."
FYI, http://www.truecrypt.org/downloads.php links to http://truecrypt.sourceforge.net/downloads/TrueCrypt%20Setup%205.0.exe.
Klingon Software is not released, it escapes, inflicting terrible damage onto the enemy as it does
I'm not sure whether I like the idea of encrypting my entire disk. I don't really like the idea of not being able to boot a live CD to fix something should the need arise. Unless I'm misunderstanding the features, it won't be possible.
I know it doesn't happen often, but there is not anyone here that hasn't at least once screwed up something on his system and needed to boot a livecd to fix a configuration file. With total disk encryption, what do you do? You're boned, as far as I can see and I don't think that I really like the idea.
As I'm writing this, the thought pops into my head that "you can probably just enter your passphrase from the live environment while trying to mount the filesystem". Is this how things actually work? It's a genuine question and I'd appreciate not being modded down for asking it. Of course someone probably will.
TrueCrypt can do this when used in 'Traveler' mode.
It does install a system driver when in use, but the driver can reside purely on the unencrypted portion of the flash drive.
James
Not really.
:)
I also duel boot windows / linux, and ran into the following errors tryin to set it up with TC
You can't encrypt the whole drive if you have more than 1 OS on 1 drive (not partition)
You can encrypt only your windows partition, but ONLY if you are using the windows boot manager in your MBR, and move grub to your linux partition.
If you have 2 drives, 1 for windows and 1 for linux, you should be home free.
Guess i'll stick to encrypted volumes
The documentation that comes with the system encryption is sparse. I ran through the tests on my RAID-0 laptop and at boot time I get "ERROR: Insufficient memory" (I've got 2GB... and a 64 bit CPU) so it failed. :-/
Additionally the documentation is very sparse when it comes to features like Windows Hibernation; it implies in the docs that it disables hibernation but who knows
Forums are down so can't see the rest of the users screaming (assuming they can boot, of course...)
If the Mac version is any example, TrueCrypt now uses FUSE. That's not /completely/ independent of the kernel, but it's still rather more stable than having to recompile TC every time you build a new kernel.
Hail Eris, full of mischief...
E pluribus sanguinem
You're able to write protect the hidden area and write to the dummy partition. The only bad thing that it reports is that data written to the hidden partition area will appear as a write error. So you can technically have updated files in the dummy area.
Whole disk encryption is meant to avoid the possibility that an application (possibly without your knowledge) could write sensitive data to a location that is not encrypted.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
If it runs while loading the OS (kernel), and then runs when that OS mounts a filesystem, it must be running in two different places since in one case the I/O is done through BIOS calls and in the other case through device driver calls in a kernel. That doesn't sound like independence from the kernel to me. It sounds like it has to be compiled into the kernel (otherwise the / filesystem isn't encrypted), or at least inside initramfs (which is still compiled into the kernel).
I'm really not concerned about the install process. I'm concerned about reliability aspects, including the ability to support the way I structure my file systems. Performance would be good, too, but there is obviously a certain amount of performance hit for the encryption. For example, things like direct write should still continue to work faster, by doing the encryption of data blocks directly from the original buffer to a temporary (not copy to a temporary first), then completing the write.
now we need to go OSS in diesel cars
As referenced in another reply, http://technocrat.net/d/2007/3/9/15796this user was obviously not aware that DriveLock can be very easily bypassed if the persons taking your hardware have access to a clean-room facility.
Lastly, your definition of sensitive data might be different than mine. Without full disclosure, how can I be expected to make an informed decision about the strength of protection required?
Eagles may soar, but weasels don't get sucked into jet engines.
Only the Windows version supports whole disk encryption, not Linux one.
- Anybody with admin rights to the machine can remove the FDE (And even though the FDCC guidelines (Which all government agencies are supposed to follow and implement as of Jan 31, 2008 (yea right)) say this is a no-no, all it takes is someone, somewhere to sign off saying "We allow local admin rights because: " and viola! Admin rights.
- No support for two factor authentication.
- No support for the "I forgot my password" syndrome beyond saying: Here is a rescue CD, and here is the password, and have fun! Commercial products allow for a challenge-response one time login/password change request.
- No support for multiple users to log in to the laptop (Ties into the point above).
- No support for policies (Password length/complexity, time restrictions, that sort of thing)
- No support for automatic updates (which I guess is a moot point because of the above issue)
- No support for automatically updating the header files (Needed when the user changes password, a new user is given rights to the machine, etc.)
- And the biggest one: Truecrypt would need to have a champion at the highest levels before it has a chance of being deployed.
Some of these problems also prevent Truecrypt from being used as a portable media encryption option in the government as well. For example there is no easy way that a end user can create a container and say "Only myself and Bob can open it".In short, it is close to being useful beyond the SOHO market, but not quite there. Reading through there todo's I see that they are going to be addressing some of these issues, and I suspect that with enough constructive input, they will eventually meet the other requirements as well.
What can I say. I needed the karma.
"They said I probly shouldn't fly with just one eye," "I am Bender. Please insert girder."
It's not part of Ubuntu in a useful way.
Here's what it takes for it to be a real part of Ubuntu:
On a default install, EVERYONE should get a truecrypt container file that's of a fair size (maybe relative to the HDD size with a max limit, and min limit - unless the drive is really too small then it's not installed), with a random password.
Now truecrypt becomes far far more useful to everyone, because everyone now has plausible deniability.
All that marketing bullshit about hidden partition vs dummy partition is stupid, if the default install doesn't come with container files, and you create some, that bumps you up the list of "people to waterboard" or "ask nicely for all their passphrases".
Whereas if the default install came with encrypted container files, they can't harass every ubuntu user.
Naturally it has to be done in a way so that:
1) The container file access times and modified times aren't changed.
2) The container file(s) or their contents are never backed up automatically by the system or indexed etc. Otherwise the risk of people finding out that you are using crypto goes up - they just have to get hold of your backups and do some comparisons and then your quality of life goes down.
3) Using the container file is easy.
If people want to backup the container or files from the container, they must really use their brains otherwise they might have problems later on...
(I submitted this suggestion to ubuntu some time ago, not sure if they will do it - Ubuntu might get banned in some countries, or at least the default edition with crypto might get banned).
Anyway enough for now - bedtime...
For whatever reason, the author of TrueCrypt wrote his own implementation of AES. This means even if someone put up the cash to apply for a cert, it'd probably take much longer to get anything other than assurance level 1 than most people are willing to wait.
:-(
In any case it costs a lot of money and they only test binaries which makes anything that links into a kernel difficult unless it's only a library core common among implementations which is linked at install time or something.
It's a real pain.
Most people are fine with FIPS-compliant but not listed, and not many government types use anything but windows on laptops, so you're kinda screwed there being one of very few who need it.
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
Still no option to mount a TrueCrypt volume on an NTFS junction point, alas.
PGPdisk has had this for ages. Means you don't have to expose to all and sundry who can see your machine that another drive has just appeared.
Would very much like to see this in the next version.
pi = 2*|arg(God)|
Of course, then your BIOS isn't encrypted, so you encrypt it and need another one below that to decrypt it, but then that bottom one isn't encrypted.
It's encrypted boot code all the way down!
afaik, the truecrypt code has never been audited for security issues by professional cryptographers. does anyone know if i'm mistaken?
if the code has never been audited doesn't it seem a bit irresponsible to recommend truecrypt?
That would certainly explain firefox's load time :b
"Algebraical symbols are used when you don't know what you are talking about" - BCS