Slashdot Mirror
TrueCrypt Audit: No NSA Backdoors
Mark Wilson writes: A security audit of TrueCrypt has determined that the disk encryption software does not contain any backdoors that could be used by the NSA or other surveillance agencies. A report prepared by the NCC Group (PDF) for the Open Crypto Audit Project found that the encryption tool is not vulnerable to being compromised. However, the software was found to contain a few other security vulnerabilities, including one relating to the use of the Windows API to generate random numbers for master encryption key material. Despite this, TrueCrypt was given a relatively clean bill of health with none of the detected vulnerabilities considered severe enough to lead "to a complete bypass of confidentiality in common usage scenarios."
Where's the fun in there not being any nefarious evil backdoors??!?!?
How am I supposed to feed my narcissistic persecution complex that the NSA is focusing billions and billions of dollars of resources just to spy on me and me alone when they can't even put a backdoor in TrueCrypt??!?!?
AntiFA: An abbreviation for Anti First Amendment.
Now we just need an audit of the auditors to make sure they weren't compromised and we can safely use TrueCrypt again.
Wasn't the NSA accused of suggesting/modifying various encryption standards in order to weaken them? In which case they don't need back doors into the software as they can already unlock the data.
I am Slashdot. Are you Slashdot as well?
... that we know off...
It's not because we don't see that it is not there !
Is this a deliberate choice of quote,or just randomly apropos?
You can fool all the people all of the time if the advertising is right and the budget is big enough. -- Joseph E. Levine
I am Slashdot. Are you Slashdot as well?
They didn't say "no backdoors", but no NSA backdoors. So what they are saying is there are backdoors, just not NSA.
This was very reassuring to see and I'm very glad the audit was finished finally. The 2nd to the last version (v7.1a) is the gold standard for multi-platform encryption where you can be reasonably sure the NSA/FBI doesn't have a back door (or access to the keys) like they would with Bitlocker etc..
It's good to remember that the ones the NSA purposely weakened were flag by private experts as being suspect before they were even in place (so people avoided them) and then confirmed as being purposely weakened by the Snowden docs - so the bad ones were flagged - DuckDuckGo is your friend on that. You definitely wouldn't want to be doing the NSA's work though in spreading generalized FUD (fear, uncertainty, doubt) about this encryption application (so people don't use it) that was also pointed out as "secure" by Snowden.
"time-boxed nature of the engagement prevented auditors from reviewing the source code in
its entirety"
"...as it is difficult to fully test code on multiple operating systems and configurations."
So in other words, they can't properly test the software and won't be able to.
So in other words, this story is misleading and seems more like propaganda to help bolster TrueCrypt's reputation.
Whoever you are, you are fantastic people. You've helped millions of people worldwide protect their privacy. And you even had to bear some mentally diseased cretins accusing you of being NSA guys.
Thank you for the fantastic piece of software you have designed.
The NSA is monitoring this thread to identify all of you naysayers...
Unless /u/OzPeter is already working for the NSA
The shellshock bug went on for a long time with many eyes on the code. How do we know the auditors weren't outmatched and just missed the backdoor?
If this hadn't been done ten years before he talked about, it's been done by now. They have everything they want. Live accordingly.
That is all.
Everyone kept saying they would find a backdoor. Don't you think that logically the NSA shut down the project because they couldn't find a backdoor in it? They would have left it alone if it had an NSA backdoor in it.
they'd be barred from telling us so under pain of GITMO.
/u/OzPeter
Found the redditor!
...NSA
Ex-government organisation
Last year when TrueCrypt developers suddenly threw in the towel, everyone assumed it was because TrueCrypt had been forced been subverted by the NSA, similar to Lavabit. If that's not the case though, as the audit suggests, then why did the developers suddenly quit?
"1) One part is tasked with compromising the information infrastructure of our enemies"
And yet they compromise the infrastructure of your allies too. Or maybe I missed the memo and you have pretty much only enemies ?
A non-technical consumer won't know about NCC Group, or Open Crypto Audit Project and will have no reason to trust them.
They need a government/private source that they choose to trust (for any reason good or bad) to endorse their use of encryption.
If trust is lacking, then encryption is not useful to the mass market.
It's a reasonable assumption that the TrueCrypt developers were pressured to subvert the project, but shut it down instead. As you said, similar to Lavabit; recall that Ladar didn't give the Feds what they wanted, he shut down the service rather than compromise his users. I think the same thing happened with Truecrypt.
The audit suggests that no NSA backdoor actually made it into the product. It's still very likely that the gov't tried to force a backdoor, and the developers' response was to abandon ship.
Last year when TrueCrypt developers suddenly threw in the towel, everyone assumed it was because TrueCrypt had been forced been subverted by the NSA, similar to Lavabit. If that's not the case though, as the audit suggests, then why did the developers suddenly quit?
Because they quit instead of implementing the backdoor/vulnerability? Like Lavabit, they had two choices: comply with the demands or abandon the project.
I don't think you quite understood what happened at Lavabit. Lavabit didn't shut down because the NSA got in, they shut down because the NSA wanted to get in and was throwing around their (il-)legal weight. Lavabit have no choice but to close up shop, or go along with the NSA's wishes.
Same thing here. The NSA was likely making legal threats to those working on the project, and they wanted nothing to do with it.
Come on - if the random number generation isn't random... should be pretty obvious..
https://www.schneier.com/essays/archives/2007/11/did_nsa_put_a_secret.html
It only takes one unlocked door to allow somebody into a bank.
A security flaw on an API is a immediate security threat, and they shouldn't be making such a call anyways.
And the only way to be sure of the security is to audit it yourself and compile it yourself. I'm making my own, then I'm going to encrypt a few hundred petabytes of randome data and send it to the NSA so their machines can gum it to death.
ahhhh.... "the dreaded Rear Admiral "
The RNG issue on Windows is not trivial.
It would be easier and cheaper for an NSA pencil pusher to write million dollar checks to all the truecrypt developers to have them walk away and claim it is insecure, than to have a team of NSA security experts spend years unsuccessfully trying to crack truecrypt.
I doubt a code-review would find any of these.
echo '[q]sa[ln0=aln80~Psnlbx]16isb572CCB9AE9DB03273snlbxq' |dc
Focusing on NIST and the NSA
Choose a safer curve
FOUND YET !
Existence of [Unicorns \ zombie jesus \ Invisible sky friends \ intelligent merkin ] still not disproved yet !
Because all of the asshole users, who couldn't be bothered to donate money to the people writing their encryption software, we ready and willing to donate money to other people who promised to have a look at it.
If you want people to audit TrueCrypt, the obvious choice there is the people who wrote the damn software themselves. In particular, as they already wrote the software for free, there's a fair chance that they'll use your funds to actually review the code, vs. just waiting a year or two and then saying "yeah, we looked at it, it's fine." ...but no, let's not give money to the TrueCrypt project, let's all get excited about giving money to an auditing project and give them as much cash in a few months as the TrueCrypt project would be lucky to see in ten years.
I can't blame them. If users of my software had done the same thing, I'd shut the project down with a big "fuck you" too.
From what I understand, making TrueCrypt work with UEFI systems would have required a major rewrite. It's quite possible that they were already thinking of giving up, and any government pressure just finished it off.
That's detectable.
Only if the compiler is free software. David A. Wheeler's diverse double-compiling construction requires the compiler's source code. It can provide strong evidence of freedom from "trusting trust"-type attacks for something like Clang, GCC, or Tiny C Compiler, but not for something proprietary such as Visual C++.
Fortunately, we know how to counter that threat.
Only Microsoft has the ability to counter that threat because only Microsoft owns a lawfully made copy of the source code to Visual C++. Microsoft also has an interest to promote BitLocker over TrueCrypt.
I love the bit where nerds in their dressing gowns reading slashdot pretend that they have secrets that are so vital that not only do they require completely unbreakable encryption but they pretend they are tougher than Bruce Willis and would of course be able to resist a neverending experience at the hands of some hooded torturer waterboarding you while sawing off your balls with a hacksaw.
Yeah, at least your critical data is totally "secure".