TrueCrypt Safer Than Previously Thought (ec-spride.de)

An anonymous reader writes: Back in September, members of Google's Project Zero team found a pair of flaws in the TrueCrypt disk encryption software that could lead to a system compromise. Their discovery raised concerns that TrueCrypt was unsuitable for use in securing sensitive data. However, the Fraunhofer Institute went ahead with a full audit of TrueCrypt's code, and they found it to be more secure than most people think. They correctly point out that for an attacker to exploit the earlier vulnerabilities (and a couple more vulnerabilities they found themselves), the attacker would already need to have "far-reaching access to the system," with which they could do far worse things than exploit an obscure vulnerability.

The auditors say, "It does not seem apparent to many people that TrueCrypt is inherently not suitable to protect encrypted data against attackers who can repeatedly access the running system. This is because when a TrueCrypt volume is mounted its data is generally accessible through the file system, and with repeated access one can install key loggers etc. to get hold of the key material in many situations. Only when unmounted, and no key is kept in memory, can a TrueCrypt volume really be secure." For other uses, the software "does what it's designed for," despite its code flaws. Their detailed, 77-page report (PDF) goes into further detail.

Comments

To the former TrueCrypt developers

[Anonymous Coward]

Whoever you are, wherever you are: Thank You for developing an amazing piece of software and releasing it (and the source code) for free. You improved the right to privacy of millions of people around the world.

There have been dozens of stupid, vulgar and insulting conspiracy theories about them ("Oh, they are NSA agents!"), the reality is that they must be generous and intelligent people, very rare in today's world.

Re: TrueCrypticles!

[Kjella]

So some people actually thought disk encryption is safe even if an attacker has access to the system? How so? I mean.... if you leave your front door unlocked it is apparently such that anyone else can enter without a key. I guess tat's an obvious fact that most people would agree so why then is not apparent that an unlocked encrypted disk is accessible to anyone that is logged into the system? Seriously that eludes me.

Not access to the system, access to the front door. They can't break down the door, but they can tamper with it so the next time you unlock it they copy the key or slip in with you. Which means the door isn't sufficient, but the remaining threats aren't the fault of the door. It does its job of staying locked until someone presents the right key.

Re:With all respect to Fraunhofer

[Kjella]

As long as there's somebody with an agenda, there is always the chance for foul play. If the EFF (fairly impeccable impartiality) ordered a review by a US security expert (also with impeccable impartiality) many would suspect the NSA of issuing a NSL instructing the researcher to give it a clean bill of health. Unless you've done it yourself there's always room for a conspiracy theory like the NWO controlling both the US and German governments and then some to suppress the truth. And there's also matters like competency, a totally legit audit might fail to see a cleverly hidden backdoor. Fortunately they're not mutually exclusive so you can look at the totality and estimate how likely it is that everybody's lying or if that there really was a backdoor that someone would have found it and told about it. Usually there's somebody with integrity who thinks the public needs to know, maybe not outing themselves like Snowden but I think someone, somewhere would have dropped an anonymous hint on where to look. Personally I'm getting more and more convinced the infamous 7.2 release was because they were being forced to implement a backdoor, not to warn of an existing one. That 7.1a was simply too good for our Orwellian overlords, which I don't welcome.