Green: Another update on the Truecrypt audit [LWN.net]

On his blog, Matthew Green gives an update on the plans to audit the TrueCrypt disk encryption tool. Green led an effort in 2013 to raise money for an audit of the TrueCrypt source code, which sort of ran aground when TrueCrypt abruptly shut down in May 2014. "It took us a while to recover from this and come up with a plan B that works within our budget and makes sense. We're now implementing this. A few weeks ago we signed a contract with the newly formed NCC Group's Cryptography Services practice (which grew out of iSEC, Matasano and Intrepidus Group). The project will evaluate the original Truecrypt 7.1a which serves as a baseline for the newer forks, and it will begin shortly. However to minimize price -- and make your donations stretch farther -- we allowed the start date to be a bit flexible, which is why we don't have results yet."

to post comments

Green: Another update on the Truecrypt audit

Posted Feb 21, 2015 10:57 UTC (Sat) by mat2 (guest, #100235) [Link] (3 responses)

Wouldn't it make more sense to write or develop further a clean-room reverse-engineered program that would be compatible with Truecrypt?

This would solve its legal issues, which are quite serious (there were allegations that its source code was stolen).

(of course it's not my work and not my money and so they may do everything they wish)

Green: Another update on the Truecrypt audit

Posted Feb 21, 2015 20:34 UTC (Sat) by k8to (guest, #15413) [Link] (2 responses)

How large is the surface area on a thing like this? It might be difficult to make it truly compatible without doing a similar audit.

But I speak in ignorance.

Green: Another update on the Truecrypt audit

Posted Feb 22, 2015 2:12 UTC (Sun) by abartlet (subscriber, #3928) [Link] (1 responses)

On linux you can already mount an existing truecrypt volume with cryptsetup.

But on Linux, you would just use LUKS, so this does not help the interesting case, which would be Windows users I suspect, nor tell TrueCrypt users if their data was at risk due to other factors (keys leaked into 'random' padding data, etc).

Green: Another update on the Truecrypt audit

Posted Feb 23, 2015 9:34 UTC (Mon) by petur (guest, #73362) [Link]

indeed, Windows users but also mixed OS setups

Green: Another update on the Truecrypt audit

Posted Feb 23, 2015 15:09 UTC (Mon) by ber (subscriber, #2142) [Link]

How good does http://en.wikipedia.org/wiki/DiskCryptor fare compared to TrueCrypt?
(At least DiskCryptor is clearly Free Software.)