Slashdot Mirror

← Back to Stories (view on slashdot.org)

TrueCrypt Audit: No NSA Backdoors

Posted by Soulskill on from the assuming-you-can-trust-the-auditors dept.

Mark Wilson writes: A security audit of TrueCrypt has determined that the disk encryption software does not contain any backdoors that could be used by the NSA or other surveillance agencies. A report prepared by the NCC Group (PDF) for the Open Crypto Audit Project found that the encryption tool is not vulnerable to being compromised. However, the software was found to contain a few other security vulnerabilities, including one relating to the use of the Windows API to generate random numbers for master encryption key material. Despite this, TrueCrypt was given a relatively clean bill of health with none of the detected vulnerabilities considered severe enough to lead "to a complete bypass of confidentiality in common usage scenarios."

4 of 142 comments (clear)

  1. Re:Quis custodiet ipsos custodes? by OzPeter · · Score: 5, Funny

    We need to audit the auditors of the auditors as well.

    So it's auditors all the way down?

    --
    I am Slashdot. Are you Slashdot as well?
  2. Re: That's what they WANT you to believe! by Anonymous Coward · · Score: 5, Informative

    Look everyone, a NSA shill.

  3. Re:Tin foil hat time by Andy+Dodd · · Score: 5, Interesting

    The only case I know of where an algorithm was actually backdoored was one of the random number generation schemes... The algorithm in question happens to be (IIRC) quite fast.

    In other cases (DES I think??? I could be wrong.) the NSA recommended some oddball changes. No one could find a negative consequence of them so they went in - a decade or so later, it turns out that the original implementation of DES DID have a cryptographic flaw and the NSA recommendations fixed that.

    Keep in mind there are two parts of the NSA, ones which have in many ways highly conflicting goals:
    1) One part is tasked with compromising the information infrastructure of our enemies - these are the ones who keep on making the news these days
    2) Another part is tasked with protecting our critical information infrastructure, especially with protecting data sensitive to national security. These are the people who do Type I crypto certification, worked on creating SELinux, etc. These rarely make the news but in general, from our perspective these are the good guys. You can tell that AES-256 is NOT backdoored by the NSA since they allow it to be used to protect classified information (NSA Suite B - you can assume anything in Suite B is solid since the NSA is using it themselves.)

    --
    retrorocket.o not found, launch anyway?
  4. Re:That's what they WANT you to believe! by Anonymous Coward · · Score: 5, Funny

    It enlarges your penis, citizen.

    You should compile with that flag every time for best results. Tell your friends.