TrueCrypt Audit: No NSA Backdoors

Mark Wilson writes: A security audit of TrueCrypt has determined that the disk encryption software does not contain any backdoors that could be used by the NSA or other surveillance agencies. A report prepared by the NCC Group (PDF) for the Open Crypto Audit Project found that the encryption tool is not vulnerable to being compromised. However, the software was found to contain a few other security vulnerabilities, including one relating to the use of the Windows API to generate random numbers for master encryption key material. Despite this, TrueCrypt was given a relatively clean bill of health with none of the detected vulnerabilities considered severe enough to lead "to a complete bypass of confidentiality in common usage scenarios."

Comments

Tin foil hat time

[OzPeter]

Wasn't the NSA accused of suggesting/modifying various encryption standards in order to weaken them? In which case they don't need back doors into the software as they can already unlock the data.

Re:Tin foil hat time

[Anonymous Coward]

Why don't you go inform yourself as to which encryption standards those were and then come back and actually contribute to the discussion, instead of mindlessly speculate?

Re:Tin foil hat time

[Anonymous Coward]

Why don't you go inform yourself as to which encryption standards those were and then come back and actually contribute to the discussion, instead of mindlessly speculate?

You don't want mindless speculation, yet you're reading Slashdot comments?

Re:Tin foil hat time

[plover]

Yes, the NSA has been accused of colluding with RSA to promote the Dual_EC_DRBG random number generator as a standard, despite claims that it contained a backdoor. https://en.wikipedia.org/wiki/... . The NSA has also been accused of interfering with standards that would enable ubiquitous effective encryption for popular communications tools, such as phones and email, resulting in the current hodgepodge of patchwork. Sure, you may use TLS to send and retrieve your email to and from your ISP, but the data is unencrypted in their servers, and is vulnerable to interception there. Your cell calls may be encrypted, but Chris Paget demonstrated at DEFCON how easy that is to defeat, using his almost legal homemade version of a Harris Stingray. And the encryption algorithms used by cell phones only protect the data flying over the airwaves, not on the cellular wired infrastructure which is already required to be vulnerable by CALEA.

However, the existence of one backdoor in one algorithm does not prove or disprove the existence of backdoors in other algorithms. Most exploitable weaknesses we do know about come from either protocol flaws or implementation errors, and these auditors found evidence of neither.

obvious logic

[slashmydots]

Everyone kept saying they would find a backdoor. Don't you think that logically the NSA shut down the project because they couldn't find a backdoor in it? They would have left it alone if it had an NSA backdoor in it.

Re:What if the backdoor is well hidden?

[squiggleslash]

Who knows? On the other hand, the many eyes argument with ShellShock is dubious: most people who would have recognized it didn't realize the implications as they weren't looking at it from a security standpoint, and few people actually likely touched or had reason to view that part of the code.

This story, on the other hand, is about an actual security audit. In theory, it is more comprehensive, the researchers were looking for bugs, had a security background and agenda, and so would likely have picked up on ShellShock had it been Bash they were auditing rather than TrueCrypt.

I'm not suggesting there's no chance they've missed anything, but I am saying the process is considerably more thorough and less likely to make a mistake. Bear in mind TrueCrypt has had "many eyes" for a decade or so too. And "many eyes" did, eventually, pick up on ShellShock, it just took longer than anyone would hope.