Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TrueCrypt Master Key Extraction And Volume Identification

volatility-labs.blogspot.com

Post reply on HN
Print view View original

11–20 of 75 posts

Re: TrueCrypt Master Key Extraction And Volume Identification

#11

Post by randywaterhouse »

mmastrac wrote: post #3
randywaterhouse wrote: post #2

Interesting writeup and cool that Mr. Ligh has provided these plugins / tools. On the whole though, doesn't appear to contain much novel information. Of course, partition-only encryption has weaknesses in that the OS may store data in another partition (i.e. you've encrypted the "D:" drive but Windows just dumps a cached file to "C:", let alone the whole pagefile challenge). So you need to trust your OS to not write…

One important thing this analysis points out: using a truecrypt volume (ie: a USB stick) on a non-truecrypt system is dangerous.

Right.

This would emphasize the need to always be cautious in your use of cryptosystems, since you cannot simply claim "oh my data is Truecrypt'd". That will not save you from everything by itself. But if you look into the documentation, Truecrypt itself warns you about using it, and the threat model is very careful in defining what steps you need to take to adequately protect your data with Truecrypt.

It's one of those things where for most people, just a file-volume (the simplest kind where it's just a file that can be mounted as a block device), will do fine. The write-to-disk wouldn't happen very often, and to lose your data to a thief would require both the unlikely "OS dumped the memory to disk" (meaning the OS doesn't respect the flags TC puts on that memory), AND on top of that "a thief stole your laptop/desktop/external". If your adversary is organized crime, a law enforcement agency, or some other state-like actor with heavy-duty resources and specifically wants y-o-u... Then you'll need to be very careful and use a full disk encryption solution, or rather just not use a computer.

Know your tools. Know your adversary. Sleep a little easier knowing both. Or turn paranoid.

Re: TrueCrypt Master Key Extraction And Volume Identification

#12

Post by vezzy-fnord »

gesman wrote: post #6

The new era of encryption will be marked not by making existing encryption solutions more secure, but by concealing the very act of existence of encrypted data. "Here's my data but you cannot read it" - does not runs so well with courts, high stakes competitors and deep pocketed enemies. Once it is known "what to crack" the "how to" solution will be found. "Rubber hose cryptography" is one of these :) If you're not p…

That would be steganography then, which is distinct.

Re: TrueCrypt Master Key Extraction And Volume Identification

#13

Post by deeringc »

gesman wrote: post #6

The new era of encryption will be marked not by making existing encryption solutions more secure, but by concealing the very act of existence of encrypted data. "Here's my data but you cannot read it" - does not runs so well with courts, high stakes competitors and deep pocketed enemies. Once it is known "what to crack" the "how to" solution will be found. "Rubber hose cryptography" is one of these :) If you're not p…

The flip side of this is that it becomes impossible for someone to prove that they haven't got an encrypted volume stored somewhere. It will be interesting to see in which way the courts go with this.

Re: TrueCrypt Master Key Extraction And Volume Identification

#14

Post by randywaterhouse »

gesman wrote: post #6

The new era of encryption will be marked not by making existing encryption solutions more secure, but by concealing the very act of existence of encrypted data. "Here's my data but you cannot read it" - does not runs so well with courts, high stakes competitors and deep pocketed enemies. Once it is known "what to crack" the "how to" solution will be found. "Rubber hose cryptography" is one of these :) If you're not p…

Implementations of crypto, such as Truecrypt, rely on algorithms/ciphers such as AES which (in some modes) basically appears random... But the appearance of randomness is not enough if someone is convinced there is meaningful data there. Of course, a break such as "we can tell if there's a hidden truecrypt volume" is bad, and if I recall correctly there are ways of doing this now.

You'd need to basically never transmit the data, transmission automatically implies there is something there. If you didn't transmit, just used the data locally... And it appeared random, you'd have a pretty solid case for "they can't know". But if you slip up just once it's all over. They know.

Re: TrueCrypt Master Key Extraction And Volume Identification

#15

Post by Xymak1y »

shawnz wrote: post #7
Xymak1y wrote: post #5

What does this mean for me? I have all my interal + external hard drives encrypted as well as my system drive.

This article is just an analysis of one of the inherent and well-documented weaknesses in truecrypt: the fact that the encryption key must stay in RAM the entire time you are using an encrypted volume. So, as has always been the case, treat the contents of your RAM as precious when a truecrypt volume is mounted.

Thank you.

Re: TrueCrypt Master Key Extraction And Volume Identification

#16

Post by goggles99 »

gesman wrote: post #6

The new era of encryption will be marked not by making existing encryption solutions more secure, but by concealing the very act of existence of encrypted data. "Here's my data but you cannot read it" - does not runs so well with courts, high stakes competitors and deep pocketed enemies. Once it is known "what to crack" the "how to" solution will be found. "Rubber hose cryptography" is one of these :) If you're not p…

I am not following you. Concealing? do you mean physically hiding the media on which it is stored? Like a flash chip in a tie clasp?

If you mean concealing as in hidden partitions, data streams, or digital Stenography - these are all easily detectable upon close inspection. If there is extra bits where none are expected, this becomes a giveaway. Perhaps enough misdirection and a custom strategy of hiding could further obfuscate the location and content of the data, but as for hiding it's existence - this is not easily accomplished (if even possible).

Re: TrueCrypt Master Key Extraction And Volume Identification

#17

Post by ot »

gesman wrote: post #6

The new era of encryption will be marked not by making existing encryption solutions more secure, but by concealing the very act of existence of encrypted data. "Here's my data but you cannot read it" - does not runs so well with courts, high stakes competitors and deep pocketed enemies. Once it is known "what to crack" the "how to" solution will be found. "Rubber hose cryptography" is one of these :) If you're not p…

Interestingly, this is something Julian Assange worked on several year before starting Wikileaks:

    Starting around 1997, he co-invented the Rubberhose deniable encryption
    system, a cryptographic concept made into a software package for the Linux
    operating system designed to provide plausible deniability against
    rubber-hose cryptanalysis;[68] he originally intended the system to be used
    "as a tool for human rights workers who needed to protect sensitive data in
    the field."
http://en.wikipedia.org/wiki/Julian_Assange#Computer_program...

Re: TrueCrypt Master Key Extraction And Volume Identification

#18

Post by maxerickson »

deeringc wrote: post #13
gesman wrote: post #6

The new era of encryption will be marked not by making existing encryption solutions more secure, but by concealing the very act of existence of encrypted data. "Here's my data but you cannot read it" - does not runs so well with courts, high stakes competitors and deep pocketed enemies. Once it is known "what to crack" the "how to" solution will be found. "Rubber hose cryptography" is one of these :) If you're not p…

The flip side of this is that it becomes impossible for someone to prove that they haven't got an encrypted volume stored somewhere. It will be interesting to see in which way the courts go with this.

That's always been impossible.

Re: TrueCrypt Master Key Extraction And Volume Identification

#19

Post by mrfusion »

shawnz wrote: post #7
Xymak1y wrote: post #5

What does this mean for me? I have all my interal + external hard drives encrypted as well as my system drive.

This article is just an analysis of one of the inherent and well-documented weaknesses in truecrypt: the fact that the encryption key must stay in RAM the entire time you are using an encrypted volume. So, as has always been the case, treat the contents of your RAM as precious when a truecrypt volume is mounted.

How would you treat your RAM contents as precious? Just making sure you're on a pristine machine, and nothing else is running? Can other unrelated processes access the key from RAM?

Re: TrueCrypt Master Key Extraction And Volume Identification

#20

Post by pudquick »

Xymak1y wrote: post #5

What does this mean for me? I have all my interal + external hard drives encrypted as well as my system drive.

It means if you're worried about the contents of your encrypted drives being uncovered, you need to make sure no malicious processes gain access to a dump of your system's memory while it's booted / running / encrypted drives are mounted.
Post reply on HN