Live data from Hacker News

TrueCrypt Master Key Extraction And Volume Identification

volatility-labs.blogspot.com

1–10 of 75 posts

Re: TrueCrypt Master Key Extraction And Volume Identification

#2
Interesting writeup and cool that Mr. Ligh has provided these plugins / tools. On the whole though, doesn't appear to contain much novel information.

Of course, partition-only encryption has weaknesses in that the OS may store data in another partition (i.e. you've encrypted the "D:" drive but Windows just dumps a cached file to "C:", let alone the whole pagefile challenge). So you need to trust your OS to not write the masterkey to disk, which is widely acknowledged. I personally run with no page file, so memory ought not to be written to disk by the OS itself (barring a malicious adversary), although this solution isn't the best for someone on 1GB RAM.

Full-disk encryption would block this attack, i.e. encrypted swap on Linux (crypttab makes this quite easy) or system-drive on Truecrypt. Even if it's dumped to disk, you can't get it, again barring online access to the system. Online access this is all null and void regardless as they could just issue commands to dump memory to disk no matter what you've done!

Re: TrueCrypt Master Key Extraction And Volume Identification

#3

Interesting writeup and cool that Mr. Ligh has provided these plugins / tools. On the whole though, doesn't appear to contain much novel information. Of course, partition-only encryption has weaknesses in that the OS may store data in another partition (i.e. you've encrypted the "D:" drive but Windows just dumps a cached file to "C:", let alone the whole pagefile challenge). So you need to trust your OS to not write…

One important thing this analysis points out: using a truecrypt volume (ie: a USB stick) on a non-truecrypt system is dangerous.

Re: TrueCrypt Master Key Extraction And Volume Identification

#6
The new era of encryption will be marked not by making existing encryption solutions more secure, but by concealing the very act of existence of encrypted data.

"Here's my data but you cannot read it" - does not runs so well with courts, high stakes competitors and deep pocketed enemies.

Once it is known "what to crack" the "how to" solution will be found. "Rubber hose cryptography" is one of these :)

If you're not possessing anything to crack (or so "they" think), you're safe :)

Re: TrueCrypt Master Key Extraction And Volume Identification

#7
post #5

What does this mean for me? I have all my interal + external hard drives encrypted as well as my system drive.

This article is just an analysis of one of the inherent and well-documented weaknesses in truecrypt: the fact that the encryption key must stay in RAM the entire time you are using an encrypted volume. So, as has always been the case, treat the contents of your RAM as precious when a truecrypt volume is mounted.

Re: TrueCrypt Master Key Extraction And Volume Identification

#9
In this blog post, forensic experts realize TrueCrypt uses headers.

But theres still a valuable lesson: a half-encrypted system is a not encrypted system, and it will leak information. Theres a paper on this from 2008 I think, before TrueCrypt implemented full operating system encryption:

https://www.schneier.com/paper-truecrypt-dfs.html

Post reply on HN