Slashdot Mirror
Schneier, UW Team Show Flaw In TrueCrypt Deniability
An anonymous reader writes "Bruce Schneier and colleagues from the University of Washington have figured out a way to break the deniability of TrueCrypt 5.1a's hidden files. What about the spanking-new TrueCrypt 6? Schneier says that 'The new version will definitely close some of the leakages, but it's unlikely that it closed all of them.' Meanwhile, PC World is reporting that the problems Schneier and colleagues found are bigger than just TrueCrypt. Among their discoveries: Word auto-saves the contents of encrypted files to the unencrypted portions of your disk, and this problem should apply to all non-full disk encryption software. Their research paper will appear at Usenix HotSec '08."
HotSex 08? Where do I sign up!
Caesar si viveret, ad remum dareris.
Comment removed based on user account deletion
So Vista, Word, and Google Desktop make truecrypt less viable? Im Shocked I tell you! Shocked. Please..If you are serious about using truecrypt please tell me that you are savy enough to know how to get around some of these holes. Googledesktop?-aka, I spy on everyone and read your brain desktop? Its like saying my iron has a security hole if someone installs a hardware keylogger on my system. Duh! But just because Schneier is involved, the hacking gods must bow and agree with every word he says. Anyway, now Im rambling, but I use truecrypt only on my secure linux box, which doesnt have these problems. I hide all my stuff that would get me into lots of trouble if!@#@!#%T^GD no carrier
"It's ok, I'm completely secure as long as my iron is off"
Some of you may not be aware of the stature of Bruce Schneier in the field of computer security, so here is some background information:
http://geekz.co.uk/schneierfacts/facts/top
Bruce Schneier once decrypted a box of AlphaBits.
Most people use passwords. Some people use passphrases. Bruce Schneier uses an epic passpoem, detailing the life and works of seven mythical Norse heroes.
Bruce Schneier knows Alice and Bob's shared secret.
Vs lbh nfxrq Oehpr Fpuarvre gb qrpelcg guvf, ur'q pehfu lbhe fxhyy jvgu uvf ynhtu.
Bruce Schneier's secure handshake is so strong, you won't be able to exchange keys with anyone else for days.
Bruce Schneier knows the state of schroedinger's cat
Bruce Schneier writes his books and essays by generating random alphanumeric text of an appropriate length and then decrypting it.
When Bruce Schneier observes a quantum particle, it remains in the same state until he has finished observing it.
If we built a Dyson sphere around Bruce Schneier and captured all of his energy for 2 months, without any loss, we could power an ideal computer running at 3.2 degrees K to count up to 2^256. This strongly implies that not only can Bruce Schneier brute-force attack 256-bit keys, but that he is built of something other than matter and occupies something other than space.
Though a superhero, Bruce Schneier disdanes the use of a mask or secret identity as 'security through obscurity'.
${YEAR+1} is going to be the year of Linux on the desktop!
Damn. I thought someone had found a neat new extension to Word, called "and", that bypassed your security.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
I was wondering about that, I was thinking your security flaw was as simple as someone saying: "Hey, you left your iron on!" then they just rummage through your shit while yer distracted.
"It's ok, im completely secure as long as my iron is off"
Seems that someone found a semi-reliable decryption mechanism that can not only stand up to that, but can reverse an even stronger algorithm known as "volcano".
Didn't mean to dash your dreams, but you know how the security game goes...
Quo usque tandem abutere, Nimbus, patientia nostra?
I've been using fire 2.0 for a year already.
I encrypt using a one way algorithm know as "fire" that transforms all my secrets into ashes.
Is that the algorithm invented by the Greek hacker, Prometheus? I heard he got in a bit of trouble over it, he ended up somewhere like Guantanamo, but eventually was rescued.
"Keep in mind, though, that you can simply add exceptions to your updatedb.conf file, such that the directories/partitions you list will not be indexed (and hence will not be locatable by slocate)."
yes, put your hidden directories/partitions in /etc/slocate then slocate will not reveal their existence.
It seems to me there is something wrong with this sheme but I cannot put my finger on it. Hum ... but then again I'm not a security specialist.
The only thing backdoored around here is your mom.
So, just to play along, what software do you propose to use on the mac to provide deniable encryption?
You could try this program called TrueCrypt. It seems to work okay.
"And there be unix which have made themselves unix for the kingdom of heaven's sake." - Matt. 19:12
This algorithm takes care of that:
do {
NextVolumePassword = EnhancedInterrogation.output;
if ( Subject.dead ) throw EndInterrogationException;
NewVolume = MountNextVolume( NextVolumePassword );
cd NewVolume;
VolumeSize = GetVolumeSize;
} while ( VolumeSize > 0 )
But, I wanted socialized health insurance!
You lost me after the first "M$".
You mean it's a one way hash function!
And you're a captain in the obvious army!
So, just to play along, what software do you propose to use on the mac to provide deniable encryption?
You could try this program called TrueCrypt. It seems to work okay.
yup, ...until some folks showed flaws in TrueCrypt deniability
Now that's an attempt for infinite mod points!
*ouch!* Give it to me *ow!* not that hard! damn...
PM
yup, ...until some folks showed flaws in TrueCrypt deniability
You should just use a Mac. I've never experienced any bugs with its built-in encryption options.
"And there be unix which have made themselves unix for the kingdom of heaven's sake." - Matt. 19:12
yup, ...until some folks showed flaws in TrueCrypt deniability
You should just use a Mac. I've never experienced any bugs with its built-in encryption options.
And what about deniability, then?
And what about deniability, then?
You could try TrueCrypt. I think it works on Macs.
"And there be unix which have made themselves unix for the kingdom of heaven's sake." - Matt. 19:12
i double encrypt EVERYTHING, even my /. posts, with ROT 13! /Bruce Schneier whistles white noise.
Utilizing the synergization of benchmark e-solutions to pre-workaround action items!
Replying to your sig... Get out of Ohio... Leaving there 10 years ago was the smartest thing I've ever done.