Slashdot Mirror
Security Researchers Want To Fully Audit Truecrypt
Hugh Pickens DOT Com writes "TrueCrypt has been part of security-minded users' toolkits for nearly a decade — but there's one problem: no one has ever conducted a full security audit on it. Now Cyrus Farivar reports in Ars Technica that a fundraiser reached more than $16,000 in a public call to perform a full security audit on TrueCrypt. 'Lots of people use it to store very sensitive information,' writes Matthew Green, a well-known cryptography professor at Johns Hopkins University. 'That includes corporate secrets and private personal information. Bruce Schneier is even using it to store information on his personal air-gapped super-laptop, after he reviews leaked NSA documents. We should be sweating bullets about the security of a piece of software like this.' According to Green, Truecrypt 'does some damned funny things that should make any (correctly) paranoid person think twice.' The Ubuntu Privacy Group says the behavior of the Windows version [of Truecrypt 7.0] is problematic. 'As it can't be ruled out that the published Windows executable of Truecrypt 7.0a is compiled from a different source code than the code published in "TrueCrypt_7.0a_Source.zip" we however can't preclude that the binary Windows package uses the header bytes after the key for a back door.' Green is one of people leading the charge to setup the audit, and he helped create the website istruecryptauditedyet.com. 'We're now in a place where we have nearly, but not quite enough to get a serious audit done.'"
I am shocked, and frankly a little pissed off that Version 6 and Version 7 aren't identical.
Thirty four characters live here.
Yeah, it's a typo. The privacy report says in the last full paragraph on page 13:
As it can't be ruled out that the published Windows executable of TrueCrypt 7.0a is compiled from a different source code than the code published in “TrueCrypt 7.0a Source.zip” we however can't preclude that the binary Windows package uses the header bytes after the key for a back door.
Seems the author retyped the statement themselves rather than just copying and pasting then the summary carried it over.
Well, we can't trust that copy/paste hasn't been back-doored.
TrueCrypt has a custom license and it is unclear how it mixes with other licenses. This makes code-sharing between TrueCrypt and other projects problematical.
According to TFA nobody knows who wrote TrueCrypt.
The answer to the problem is simple: relicense TrueCrypt. If there are no known authors, there's nobody to complain.
All typos in the writeup aside, the TrueCrypt FAQ states:
In addition to reviewing the source code, independent researchers can compile the source code and compare the resulting executable files with the official ones. They may find some differences (for example, timestamps or embedded digital signatures) but they can analyze the differences and verify that they do not form malicious code.
If so, why would it cost $16,000 to do that? Heck, I bet somebody would do that, and also do "a full security audit" of the source code, for free.
When I used to use TrueCrypt years ago, I assumed someone had already done that. But I never found any proof, so I stopped using it. Will the $16,000 maybe be used to pay someone to do that formally and publish the results?
...I thought the main point of the "open source is more secure" argument was that this process supposedly happened on its own, organically?
For your security, this post has been encrypted with ROT-13, twice.
Yeah, it's a typo. The privacy report says in the last full paragraph on page 13:
As it can't be ruled out that the published Windows executable of TrueCrypt 7.0a is compiled from a different source code than the code published in “TrueCrypt 7.0a Source.zip” we however can't preclude that the binary Windows package uses the header bytes after the key for a back door.
Seems the author retyped the statement themselves rather than just copying and pasting then the summary carried it over.
As I can't make sense of this sentence even as corrected, I however can't preclude that there is still a typo.
I am not a crackpot.
...if you distribute modified versions of TrueCrypt, you cannot charge for copies. That is non-free...
...nothing in the license constitutes a promise not to sue for copyright infringement. Our counsel advises that a plain reading of this indicates that if Fedora complies with all the requirements of the TrueCrypt license, we would nonetheless have no assurance that TrueCrypt will not sue me for my acts of copying, distribution, creation of derivative works, and so forth...
TrueCrypt seems to be reserving the right to sue any licensee for copyright infringement, no matter whether they comply with the conditions of the license or not. Based on this, our counsel advised that above and beyond being non-free, software under this license is not safe to use...
Our counsel advised us that this license has the appearance of being full of clever traps, which make the license appear to be a sham (and non-free).
Given all of this, plus the problems with TrueCrypt authorship etc. I think the best course of action is replacing with a free implementation, maybe starting with something like this?
Geeks like to think that they can ignore politics, you can leave politics alone, but politics won't leave you alone.-rms
I do have one question, if you need reliable encryption and privacy why is your operating systems Windows?
"If any question why we died, Tell them because our fathers lied."
I use the best encryption ever for everything I need to keep secret. The algorithm is a simple bitwise XOR applied to every byte in the file, using the data itself as a one-time pad. Completely uncrackable unless you know the data that was used for the pad.
The output also compresses really well!
=Smidge=
While it could have been worded better, I did understand the author's intent of the comment.....
A lot of people apparently use Truecrypt 6.0a and earlier. I don't believe sourcecode for those earlier versions has ever been published. That means people could be using a binary that is completely different than the Truecrypt 7...complete with backdoors or other vulnerabilities. No matter how much you analyze Truecrypt 7 software, all Truecrypt 6.0a and earlier versions should be considered vulnerable.
It's not open source.
Not open source? The source is available for download here.
You can't compile it yourself. You have no idea what is in the source.
You certainly can compile it yourself; I built it on my old Linux iBook G4 (PowerPC), since there were no binaries available for that platform. As has been discussed above, it does have a weird license, but it is absolutely open source.
"TrueCrypt has been part of security-minded users' toolkits for nearly a decade — but there's one problem: no one has ever conducted a full security audit on it except the NSA.
FTFY
Ask the author how they compile it. Get that exact source and compile it that way. Then work out each difference. Libs get searched in directory or date order? Tweak that. Till all that is different are a few timestamps NIC MAC's, etc.
Then just audit the source. Non-trivial in itself.
Not open source? The source is available for download here.
You can't compile it yourself. You have no idea what is in the source.
You certainly can compile it yourself; I built it on my old Linux iBook G4 (PowerPC), since there were no binaries available for that platform. As has been discussed above, it does have a weird license, but it is absolutely open source.
Grandparent probably refers to Open Source Software, which is a formally defined term. It's not enough that you can merely read the source, you have to be able to redistribute it and any changes, too.
Wonder what the public key field is for?
GPG isn't perfect either. Trying to get it to compile on Solaris or AIX is a very long exercise in grabbing libraries, building them, grabbing more libraries (prereqs), and a long chain of code. It would be nice if GPG had far fewer dependencies.
Of course, there is NetPGP (which is used in NetBSD because GPG is GPL v3 licensed), but I wonder how hard it would be to port that to other operating systems and rely on its security.
Also, GNUpg is for file encryption. Volume encryption requires a different set of code.
This summary is a lot like the header of a Truecrypt volume in that it may contain crucial information in scrambled form.
The rest of TFA explains that the header of a Truecrypt volume either contains encrypted zeros (using the Linux version) or "random bits" when using the Windows client. The implication is that these "random bits" could actually contain the encrypted key to the volume.
From nearly 7 years ago and it wasn't a cryptographic backdoor.
Wait. You trust Clippy?
It looks like you're trying to keep a secret. Would you like me to search online for help on keeping secrets?
Be in no doubt. You are NOT witnessing an attempt to ensure the security of Truecrypt. You ARE seeing a standard FUD play by NSA people against one of the greatest thorns in their side.
Put this in the same category as those regular stories that appear on Slashdot and elsewhere, telling you that you CANNOT ever be sure that your erased data on your Hard-drive cannot be recovered by sophisticated forensic analysis of the magnetic surface. The NSA even paid to have a peer-reviewed paper placed in the scientific literature claiming such recovery is possible- despite the fact that such a claim is provably laughable.
Here's the mathematical proof of NONE recoverability of properly deleted data.
- let us say that you fill a HDD with target data, and now over-write that data with a RANDOM series of bytes. If the original data CAN be recovered, we have DOUBLED the capacity of the HDD, because logically there can be no distinction between the original data, and the random data used to erase it.
- now, let's say we wipe again with another random sequence. If the original data can be recovered, we have TRIPLED the capacity of the HDD, for the reason stated above.
- and again, we wipe with another random wave. If the original data is STILL recoverable, we have quadrupled the functioning capacity of the HDD.
- repeat, etc.
The problem is that the HDD is designed, given the head, recording signal, and surface material, to only support the original capacity under the signal theory that covers the current method of recording. It does NOT matter that in theory, the disk material MAY be able to save far more data with a different head, and signal method. Only the current method matters.
But the owners of Slashdot will allow periodic FUD articles to appear that DISCOURAGE people from using proper file erase tools, on the basis that its actually a waste of time, because the NSA can still get your data no matter how you erase it.
Much of what the NSA engages in is PSYCHOLOGICAL WARFARE. Major US TV networks and film studios, for instance, have been ordered to NEVER reveal the fact that ALL mobile phones in the USA have their location continually tracked by cell tower triangulation methods. While is is actually LAW in the US that every cell phone must have continuous location tracking ability, the US government believes many criminals are inherently stupid, and will allow their cell phones to produce evidence against them ***IF*** they have false ideas about how cell phone technology works. US Dramas like 'Shameless' (the US remake) and films like 'The Call' have actually informed the audience that ONLY phones with real GPS chips can be location-tracked- a complete and total lie, but a lie designed to sink into the unsophisticated minds of the sheeple.
The truth about the strength of Truecrypt is the complete LACK of stories about Truecrypt being defeated in practice. Shills will try to tell you that this is because Truecrypt is defeated in super-secret cases you can't be allowed to hear about, but this is a nonsense for two reasons. If you are a high level target of the NSA, nothing can save you, so the security of any encryption system is irrelevant. If systems like Truecrypt are defeated as part of ordinary governmental actions, the government, by law, has to allow this fact to be known (the RIGHT to a fair trial, etc).
So instead, you get this FUD attack against Truecrypt, which will persuade a certain percentage of suckers to NOT bother using Trucrypt in the first place, give up using it, or transfer to a commercial alternative that is DEFINITELY compromised by the NSA (ALL commercial encryption software is compromised).
No they weren't. They specifically say:
It's not open source. You can't compile it yourself. You have no idea what is in the source.
Which is patently false. You can know what's in the source merely by looking at it (if one couldn't this whole story wouldn't exist) and one compile it.
The current version of TrueCrypt is 7.1a. Why are they only talking of older versions?
It's not well-written.
Here's what it's saying:
* We can audit the TrueCrypt source code.
* TrueCrypt for Windows is distributed as a binary.
* We can't verify that the TrueCrypt for Windows binary is actually built from the TrueCrypt source code.
* Thus, we can't (effectively) audit the TrueCrypt for Windows binary.
They give an example of one backdoor of concern in the sentence, but really the logic is true for any arbitrary security concern.
Between the copy action and the paste action, the NSA was able to get in, read the copied text, parse it and then subtly alter it in order to cause confusion and distrust among us. We must act now!
I found an apt quotation from Edmund Burke we should all take to heart regarding acting against the NSA. I'll copy it here:
"The only thing necessary for the triumph of evil is for good men to do something."
----------------------------------- My Other Sig Is Hilarious -----------------------------------
Why? Open source can help here very much, and the most bancrupt country on Earth can do nothing to stop publishing code.
That's why it's part of this project to move TrueCrypt to the same "deterministic build" process that TOR uses. Anyone should be able to build from the source, download the binary, and get an exact match. That has become a necessary part of any security software, and a basic failing of TrueCrypt today.
Socialism: a lie told by totalitarians and believed by fools.
As was mentioned above, digital signature key used to sing Windows executable are not released. Therefore, it will never be possible to get a binary result identical to what is published on TryueCrypt website.
If the code is the same and the differences are only in an appended signature and embedded timestamps then it would be practical to verify the binary.
To be honest the last time I did such a comparison was a couple of major revisions of Dev Studio ago.
> but forgot to grant explicit permission to make derived works
They did not forget - they laid out the permissions they wanted to grant in their license.
> You have no reason to suspect that whoever wrote it, has a problem with relicensing.
Suspect? We KNOW exactly what they have a problem with and what they don't - it's right there in black and white.
The signature is appended and contains a hash of the remainder of the file (what it's signing). If you could actually recreate the TrueCrypt binary in its state before it's signed, it is absolutely trivial to verify that it's the same as what was signed in the signed binary (and thus is strictly the same, minus the signature). That's not the hard part at all.
The Tor guys just went through this process of creating deterministic builds to solve this problem. Fascinating process and some more info here: https://mailman.stanford.edu/pipermail/liberationtech/2013-June/009257.html