Slashdot Mirror
TrueCrypt 6.0 Released
ruphus13 writes "While most of the US was celebrating Independence Day, the true fellow geeks over at TrueCrypt released version 6.0 of TrueCrypt over the long weekend. The new version touts two major upgrades. 'First, TrueCrypt now performs parallel encryption and decryption operations on multi-core systems, giving you a phenomenal speedup if you have more than one processor available. Second, it now has the ability to hide an entire operating system, so even if you're forced to reveal your pre-boot password to an adversary, you can give them one that boots into a plausible decoy operating system, with your hidden operating system remaining completely undetectable.' The software has been released under the 'TrueCrypt License,' which is not OSI approved."
svefg cbfg
Well, I hope that it now supports more filesystems, because mucking about with FAT on MacOS X didn't appeal to me last time.
Every experiment which ends in a big bang is a good experiment.
The issue is described in full here:
Full release notes can be found here.
All this crypto stuff only works well if it's part of the default install and config.
Otherwise users get exposed to "rubberhose cryptography".
Basically if all users even Joe Sixpack get an encrypted partition by default, then people using crypto will be safe - they have plausible deniability.
Project homepage is here: http://www.truecrypt.org/
Release notes here http://www.truecrypt.org/docs/?s=version-history
(Btw, these links should be in the article, instead of an external (sponsored?) one).
Great, I can now maintain my geek-cred by hiding the fact that I sometimes have to boot into Windows to run things like a GPS map updater. No more microsoft on the boot menu.
Yes it is a good defence against that. Border guards aren't going to have enough time to find your encrypted containers while you are there, and if you have to give up your laptop, or if they take a copy of the HD, then they can't access the information because they don't have the password (and they can't force the password out of you, because you have already re-entered the country (assuming you are a yank)).
And if they do find a container, and force you to give up the password http://it.slashdot.org/comments.pl?sid=606473&cid=24097339 hidden volumes as described in that post.
I wank in the shower.
It's sad. I often travel between the US and China on business ( I live on the China side ). I've always been careful with sensitive data, but now I'm absolutely fascist. Why? I have no fear of the Chinese government. Besides, I work for a Chinese company. I fear my own country illegally accessing files to which they have absolutely no rights whatsoever.
Honestly. If someone works for the US government, pulls some CEO's laptop at the boarder for "inspection" and gets free access to all the company financials, would they do the right thing? How many semi-intelligent people wouldn't be tempted to start buying stock options or call their best friend with a really good "tip"? Even if they SEC investigated, they would never find the link.
Over the last several years, I've always been treated very respectfully inside China and going to and from. It is in the US, my own country, where I'm treated as if I'm already guilty.
Back to the topic at hand. TrueCrypt is a wonderful product. Everyone should be using it.
actually you can. with truecrypt I can create an encrypted volume which is just a file on my hard disk. say it's 1 gigabyte. To access it I have to type in my password "secretpass" I see a 1 gigabyte volume. now I can stop there. it's encrypted strongly enough to protect my files. I throw 200 MB of porn/corporate data/personal emails/photos of my girlfriend on there. it shows as 800MB free. Now I create a hidden volume 800 MB in size. In there I put my plans for how to kill every politician, the details of my drugrunning opperation, the plans for a nuclear weapon. etc etc etc. to access this I have to type in my second password "password2" So I boot up truecrypt, select the 1 gig file which is my virtual drive, type in "secretpass". What I then see is a 1 gig drive with 800mb free space and lots of semi-important files. if I open that same file with "password2" I'll see an 800MB drive almost full with highly important documents. There is no missing hard drive space, no hint at all that there is anything but the first drive unless I enter the second password. (side note, if you add files to the first drive then there's a chance that you'll overwrite files on the hidden drive since unless you enter that password as well then truecrypt can't see that it's there.)
True crypt is fabulous. But is it good enough to hide a body?
Hans
- depending upon the file system.
For instance, if you used ext3 then mkfs.ext3 is going to put backup super blocks all over your disk. If you then setup a hidden volume later on, some of those backup super blocks are going to get over written. An attacker - to whom you've been forced to reveal your outer volume password - could easily discover that the backup super blocks aren't the same as the real super block and deduce that you're using a hidden volume that you didn't tell them about. You could, when formating, tell mkfs.ext3 not to use any backup super blocks - but that also might look a bit suspicious. Just food for thought.
A not very powerfull small factor PC (some subnotebook barely good enough to run Linux - no need for the latest über-UMPC able to withstand Vista), with which to decrypt the content on arrival seems to be the only current solution.
At least, as an over-powerful laptop isn't needed, at least this isn't very expensive.
Also, has TrueCrypt been ported to PDAs ?
A PDA running TrueCrypt and dual SD+USB hybrids cards (Sandisk and OCZ produce such beasts) seems another even cheaper solution.
If the data can't be decrypted on the target machine when plugged with the card's USB connector, then plug it into the SD port of the PDA and decrypt data from there.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
This is discussed in the "plausible deniability" section of the TrueCrypt docs.
The recommended solution is to ensure you have a plausible use for the existing installation of TrueCrypt, for example some porn or customer records in a separate container, allowing you to deny the existence of the real container.
This means you do not have to put yourself in a situation where you are denying using TC and one tiny mistake could indicate that you have used TrueCrypt when no visible TC volume is present.
On the other hand, I'm sure most of the bootable Linux LiveCDs will continue to include TrueCrypt.
If you want to do it with Windows, use BartPE as discussed in the TrueCrypt FAQ.
you seem to have missed the point in a big way. You see a truecrypt container. You hold back the rubber hose or start with the thumbscrews. after much screaming they give you a password. You see a 1 gig volume with 200mb of confidential and mildly valuable files and 800mb of free space. It's is utterly plausible that this is all there is. there are no more files. you've got all you're gonna get. no hidden volume. Now you might try some more torture but your victim is also aware that there is no proof at all that there is any more to find. Perhaps I have a 1 gig volume with 998MB used on the outside with a 2 MB hidden volume where I keep my plans to kill the president. as for a dictionary attack, you haven't ever tried this have you? if there's a decent password then it will take you about a million years(or more) to brute force it using every computer on earth.
While most of the US was celebrating Independence Day, the true fellow geeks over at TrueCrypt released version 6.0 of TrueCrypt over the long weekend.
That might not be just a coincidence.
.sig: No such file or directory
Does anyone know if the backdoor has been made a little more user friendly? The current one takes like 3 minutes to decrypt without the password.
Winkey shortcut mapping for 64bit windows. WinKeyPlus
You know, if law enforcement "fucked up your volume" as you so nicely put it, they have just destroyed whatever evidence you where trying to hide. So why would anyone using true crypt have a problem with that?
AFAIK, yes, if you fill the decoy volume it will kill your hidden volume.
which makes you wonder how long it'll be until a tool is developed for law enforcement specifically designed to fuck up these volumes.
They can only do that if they've confiscated your laptop *and* acquired your 'decoy' password. At that point, your only concerns are they not getting your data and you being able to deny the data is there in the first place.
Somebody deleting all your sensitive files is not a bad thing to happen at that point.
So when they get the first password, they continue until they get another or they decide there's no way you could have withstood that much. And when they get your second password, they'll still go on in the hope of a third, unless the data they find would totally fill the disk.
Each time you give up something, they'll assume there may be more until they've kept torturing you for a long time without getting any more information.
I have started using TrueCrypt a few months back after my laptop got stolen. I keep two encrypted files on my laptop, one contains my personal stuff like passport scan, bank information etc. and the other the work related important documents such as internal&confidential documents, client information etc. I have buried those files in the system folder and given them name that could pass for system temp files.
I keep a copy of both on a USB key drive and on an external hard drive which never leave my home. As well as a non-encrypted copy because I'm still wondering what happens to that encrypted file if I happen to have a fucked up cluster on the drive at some point.
The rational for using encryption is not that I am afraid of the local authorities, there is nothing on my computer that would cause me any long lasting trouble, despite the fact that I live and work in a limited freedom area (Middle East), but simply to avoid opportunity theft.
For example I can't recall how many time one of my clients or partner handed me a usb key drive containing all his companies financial statement, bank account number, internal price list with profit margin, internal memo, personal info and the wifey's naked picture so that I could copy them a few documents and then forgot about the keydrive because we kept chatting.
Sometime I too need to get some files from them and I don't want to look like I'm watching them while they dig around my keydrive. I now know that everything a casual observer should not see is encrypted so I don't mind throwing my key drive over the table to someone I don't know.
I don't understand the paranoid people here who believes in plausible deniability, decoy drive and other such thing. I also wonder if the same people only use their computers in safe room with controlled EM environment and bullet proof shade.
I didn't know either that so many people carried state secrets around international airports. To those I will say that if the NSA/FSB/Interpol/MI4/Mossad/Mafia or even the local police wants the content of your drive they will get it. period. It doesn't matter what you do. Unless of course you also work for one of the aforementioned in which case you might have been trained to accept that your life is worth less than the content of said drive.
I have never been subjected to physical or psychological torture (aside from clients and some ex-gf of course) but I am not Jack Bauer and I would "come clean" very quickly. I would give the real password, not the decoy, because I believe consequences would certainly worsen my situation if my interrogators were not convinced.
I am also pretty sure that the simple sentence: "The accused has so far always refused to give his encrypted drive password." would certainly help convincing a jury beyond "reasonable doubt" (In countries where such thing even exists).
Some people here should start to seriously look at themselves and wonder if what they are trying to hide is really worth it or if it's just about mommy not finding their downloadable girlfriend picture collection.
Even the NSA would have to devote a significant part of their resources. 95^12 is over 500 sextillion combinations. So, say you've got a really really fast CPU that can do 1 billion test decrypts a second (which is unfeasibly fast at the current time). It would take that computer over 17 million years to find the password.
So, let's say that the NSA has a million CPUs at their disposal, it would still take over 17 years to decrypt. So, they'd have to be pretty sure that you have some seriously cool porn on your PC before they start devoting 100,000,000 impossibly fast CPUs to the task of cracking your password in a couple of months.
The Storm Botnet would take centuries to hack a random 12 character password (it would cut down on spam though).
Of course, if you choose 'password' as your password it might not take quite as long.
http://www.truecrypt.org/news.php
If you have to worry about it being torture-proof, you're almost certainly dead anyway.
All it needs to be, for most people, is audit-proof.
And for that you need a business case for having it. Porn is probably not a good choice.
Normally, unused blocks on a drive have whatever data pattern the formatting software puts there (typically something like "FFFFFFFFFFFFFFFF..." or "55AAAA5555AAAA55..."), or remnants of other files, or parts of free block lists and empty extents and the like. If you have a big chunk of random noise in the middle that's an indication that you've got an encrypted volume in there somewhere.
No one seems to be commenting about the new features of this release but simply on TrueCrypt in general. Am I the only one excited about the multi-core/processor support? Finally a piece of systems level software that scales with the number of cores! Makes getting a multi-core processor all the more worthwhile.
Dear paranoid freaks,
if you are so concerned about getting captured and tortured for normal/hidden/hidden(hidden)/hidden(hidden(hidden)))/ad naseum passphrases, then quit having digital copies of your stuff in the first place.
99% of the TrueCrypt userbase is just fine using it on jump drives to keep stuff secure from the guy who finds it when you lose it on the train/plane/whatever.
Quit making up impossible "movie scenarios" (there, I used a Schneierism, you HAVE to respect me now!) about how gov't agents are going to come in black helicopters for your fetish vids and the 200 page backstory you wrote for a character you rolled in middle school. No one cares.
Yours truly,
-Reality.
In Soviet Russia jokes are formulaic and decidedly non-humorous.
Since I didn't understand anything you just said, and I'm a C# Programmer who has Ubuntu installed on a few machines, I highly doubt the $10/hour lunk at the airport is going to notice...
Peter predicted that you would "deliberately forget" creation 2000 years ago...
Would this even be necessary? I can install and run Truecrypt off of a USB Thumb drive or an SD card on a Win or Lin based PC.
Yes it's necessary, because currently in Windows there's no way to run TrueCrypt unless you have admin privilege on the target machine.
The original parent wanted to use TrueCrypt to secure data before transporting them (so the loss of the USB key isn't a critical leak) and then being able to retrieve the data from the USB key once arrived at the destination, EVEN if he doesn't have admin access on the machine on which said key is plugged (and thus can't install TrueCrypt from the key).
If you use a Windows PC to install the Win version of Trucrypt, and then plug the SD card into a Win-based PDA, would it not function normally?
No. Won't work. The only thing that "Windows CE" and "Windows XP" have in common is having the word "Windows" appearing in their names. As other have pointed out both don't even run on the same architecture (x86, AMD64 and Itanium for WinXP ; ARM, MIPS and SuperH for WinCE).
So :
- either you run the usual TrueCrypt on a portable device that runs Windows *XP* (or Linux or BSD or Mac) - this was my first suggestion, anything cheap like an Asus EEE PC or an OLPC is OK.
- or you use a PDA running Windows CE (or Palm OS, or Symbian, or RIM) and use a TrueCrypt version that was adapted for the differences and recompiled for the processor.
That was my second suggestion : if there exist a version of TrueCrypt which works on PDA, then the PDA could be used to do the decryption (but stock WinXP software can't run on WinCE).
Linux is an exception : the Linux running on PDAs (Sharp Zaurus, Nokia Maemo, Trolltech GreenPhone, OpenMoko/FIC NeoRunner, etc...) is much closer to the full Linux running on desktop.
Usually the graphic interface is different (often the PDAs don't have X-Windows but use special purpose GUIs) but the system are POSIX compliant and any console software usually run as-is after being simply recompiled from source (because the processors are still different and the binaries are different - but the source is the same for console applications).
So that's the exception to the rule.
Note: That also true for a lot of different Linux enabled appliace (modem/routers, file servers, etc.) - although lots of them have very limited resource which put a hard top at what you can manage to get run.
Also, Apple is touting that their desktops' Mac OS X and the iPhone and iPodTouch's OS X are similarly very related, and some developers (like Epocrates who are making medial PDA software) have mentioned that porting their application to the portable OS X was a matter of couple of days.
On the other hand, I haven't heard the iPhone / iPodTouch having a POSIX-compatible console environment (still hearing that the current SDK imposes limits on what can be done), so I don't know if getting a console application to work on those platforms is a simple matter of recompile.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
As a Perl-Fu artist who has been living in a world of *nix for the past 12yrs. Let me just say that seeing someone use Ubuntu doesn't clue newb to me.
On the contrary, Ubuntu is the only system I have seen that provides functional GUI interfaces that don't cause me to have to jump through hoops to do any sort of advanced manual configuration.
I'm all for power, but someone who chooses Slack or regular Debian over Ubuntu is probably the type who likes hot wax poured on their balls.
It was my understanding that FAT was selected because it's inherent properties allow for plausible deniability which was a stated feature and goal of the TrueCrypt project.