Slashdot Mirror
TrueCrypt Audit: No NSA Backdoors
Mark Wilson writes: A security audit of TrueCrypt has determined that the disk encryption software does not contain any backdoors that could be used by the NSA or other surveillance agencies. A report prepared by the NCC Group (PDF) for the Open Crypto Audit Project found that the encryption tool is not vulnerable to being compromised. However, the software was found to contain a few other security vulnerabilities, including one relating to the use of the Windows API to generate random numbers for master encryption key material. Despite this, TrueCrypt was given a relatively clean bill of health with none of the detected vulnerabilities considered severe enough to lead "to a complete bypass of confidentiality in common usage scenarios."
Where's the fun in there not being any nefarious evil backdoors??!?!?
How am I supposed to feed my narcissistic persecution complex that the NSA is focusing billions and billions of dollars of resources just to spy on me and me alone when they can't even put a backdoor in TrueCrypt??!?!?
AntiFA: An abbreviation for Anti First Amendment.
Now we just need an audit of the auditors to make sure they weren't compromised and we can safely use TrueCrypt again.
Wasn't the NSA accused of suggesting/modifying various encryption standards in order to weaken them? In which case they don't need back doors into the software as they can already unlock the data.
I am Slashdot. Are you Slashdot as well?
Is this a deliberate choice of quote,or just randomly apropos?
You can fool all the people all of the time if the advertising is right and the budget is big enough. -- Joseph E. Levine
I am Slashdot. Are you Slashdot as well?
This was very reassuring to see and I'm very glad the audit was finished finally. The 2nd to the last version (v7.1a) is the gold standard for multi-platform encryption where you can be reasonably sure the NSA/FBI doesn't have a back door (or access to the keys) like they would with Bitlocker etc..
It's good to remember that the ones the NSA purposely weakened were flag by private experts as being suspect before they were even in place (so people avoided them) and then confirmed as being purposely weakened by the Snowden docs - so the bad ones were flagged - DuckDuckGo is your friend on that. You definitely wouldn't want to be doing the NSA's work though in spreading generalized FUD (fear, uncertainty, doubt) about this encryption application (so people don't use it) that was also pointed out as "secure" by Snowden.
"time-boxed nature of the engagement prevented auditors from reviewing the source code in
its entirety"
"...as it is difficult to fully test code on multiple operating systems and configurations."
So in other words, they can't properly test the software and won't be able to.
So in other words, this story is misleading and seems more like propaganda to help bolster TrueCrypt's reputation.
Whoever you are, you are fantastic people. You've helped millions of people worldwide protect their privacy. And you even had to bear some mentally diseased cretins accusing you of being NSA guys.
Thank you for the fantastic piece of software you have designed.
The NSA is monitoring this thread to identify all of you naysayers...
The shellshock bug went on for a long time with many eyes on the code. How do we know the auditors weren't outmatched and just missed the backdoor?
They didn't qualify it at all. That was the editor who wrote the story, and the Slashdot editor who quoted the story. Neither quoted it from the report. https://opencryptoaudit.org/re...
John
If this hadn't been done ten years before he talked about, it's been done by now. They have everything they want. Live accordingly.
That is all.
Everyone kept saying they would find a backdoor. Don't you think that logically the NSA shut down the project because they couldn't find a backdoor in it? They would have left it alone if it had an NSA backdoor in it.
Last year when TrueCrypt developers suddenly threw in the towel, everyone assumed it was because TrueCrypt had been forced been subverted by the NSA, similar to Lavabit. If that's not the case though, as the audit suggests, then why did the developers suddenly quit?
In that case they would simply say "We have finished our audit." and leave it at that. The implications would be clear.
It's a reasonable assumption that the TrueCrypt developers were pressured to subvert the project, but shut it down instead. As you said, similar to Lavabit; recall that Ladar didn't give the Feds what they wanted, he shut down the service rather than compromise his users. I think the same thing happened with Truecrypt.
The audit suggests that no NSA backdoor actually made it into the product. It's still very likely that the gov't tried to force a backdoor, and the developers' response was to abandon ship.
I doubt a code-review would find any of these.
echo '[q]sa[ln0=aln80~Psnlbx]16isb572CCB9AE9DB03273snlbxq' |dc
Focusing on NIST and the NSA
Choose a safer curve
That's detectable.
Only if the compiler is free software. David A. Wheeler's diverse double-compiling construction requires the compiler's source code. It can provide strong evidence of freedom from "trusting trust"-type attacks for something like Clang, GCC, or Tiny C Compiler, but not for something proprietary such as Visual C++.
Fortunately, we know how to counter that threat.
Only Microsoft has the ability to counter that threat because only Microsoft owns a lawfully made copy of the source code to Visual C++. Microsoft also has an interest to promote BitLocker over TrueCrypt.