How does secure virtual memory work with this? If data in ram, or at least is encrypted when written to disk, wouldn't that stop this? Do I know what I'm talking about?
TrueCrypt Master Key Extraction And Volume Identification
21–30 of 75 posts
Re: TrueCrypt Master Key Extraction And Volume Identification
#22Re: TrueCrypt Master Key Extraction And Volume Identification
#23Earlier quoted context omitted.
This article is just an analysis of one of the inherent and well-documented weaknesses in truecrypt: the fact that the encryption key must stay in RAM the entire time you are using an encrypted volume. So, as has always been the case, treat the contents of your RAM as precious when a truecrypt volume is mounted.
How would you treat your RAM contents as precious? Just making sure you're on a pristine machine, and nothing else is running? Can other unrelated processes access the key from RAM?
> How would you treat your RAM contents as precious?
For one, don't let anyone get physical access to the computer while it is running and the volume is mounted (even if the screen is locked). This may even apply for several minutes after the machine is turned off: https://freedom-to-tinker.com/blog/felten/new-research-resul...
> Can other unrelated processes access the key from RAM?
Processes running as the root user can.
Re: TrueCrypt Master Key Extraction And Volume Identification
#24Earlier quoted context omitted.
This article is just an analysis of one of the inherent and well-documented weaknesses in truecrypt: the fact that the encryption key must stay in RAM the entire time you are using an encrypted volume. So, as has always been the case, treat the contents of your RAM as precious when a truecrypt volume is mounted.
How would you treat your RAM contents as precious? Just making sure you're on a pristine machine, and nothing else is running? Can other unrelated processes access the key from RAM?
Well, in theory, let's say you've got a laptop encrypted with Truecrypt. You put it in sleep mode instead of switching it completely off or hibernating,because you are just nipping out for a coffee. An attacker could then steal it, lower its temperature(let's say they put it in a freezer for a while), and then extract - literally take out - the RAM from that machine and plug it into a specially prepared station which would then be used to extract the contents of that memory. In low temperatures, RAM data retention is measured in minutes, so all data you had in your system would be preserved, including the encryption key.
Unlikely? Quite, unless someone like NSA or FBI want your data. Possible? Yes, with the right resources.
Re: TrueCrypt Master Key Extraction And Volume Identification
#25The new era of encryption will be marked not by making existing encryption solutions more secure, but by concealing the very act of existence of encrypted data. "Here's my data but you cannot read it" - does not runs so well with courts, high stakes competitors and deep pocketed enemies. Once it is known "what to crack" the "how to" solution will be found. "Rubber hose cryptography" is one of these :) If you're not p…
I am not following you. Concealing? do you mean physically hiding the media on which it is stored? Like a flash chip in a tie clasp? If you mean concealing as in hidden partitions, data streams, or digital Stenography - these are all easily detectable upon close inspection. If there is extra bits where none are expected, this becomes a giveaway. Perhaps enough misdirection and a custom strategy of hiding could furthe…
TrueCrypt offers a volume-within-a-volume option. The free space of a volume normally contains random data, and the hidden volume is presumably headerless. The idea is then to put something that you might want to hide in the outer volume (freaky porn, for example), then put your actual secrets (evidence of your criminal enterprise, for example) in the hidden volume. If forced to disclose the password, then only the outer volume is apparent and you can disclose that under duress.
Re: TrueCrypt Master Key Extraction And Volume Identification
#26The new era of encryption will be marked not by making existing encryption solutions more secure, but by concealing the very act of existence of encrypted data. "Here's my data but you cannot read it" - does not runs so well with courts, high stakes competitors and deep pocketed enemies. Once it is known "what to crack" the "how to" solution will be found. "Rubber hose cryptography" is one of these :) If you're not p…
By the way, this is exactly why the NSA will not catch many terrorists. You can always hide data and you can always hide communication (which is just data written and read by two different endpoints).
Re: TrueCrypt Master Key Extraction And Volume Identification
#27[deleted]
Re: TrueCrypt Master Key Extraction And Volume Identification
#28Earlier quoted context omitted.
I am not following you. Concealing? do you mean physically hiding the media on which it is stored? Like a flash chip in a tie clasp? If you mean concealing as in hidden partitions, data streams, or digital Stenography - these are all easily detectable upon close inspection. If there is extra bits where none are expected, this becomes a giveaway. Perhaps enough misdirection and a custom strategy of hiding could furthe…
TrueCrypt offers a volume-within-a-volume option. The free space of a volume normally contains random data, and the hidden volume is presumably headerless. The idea is then to put something that you might want to hide in the outer volume (freaky porn, for example), then put your actual secrets (evidence of your criminal enterprise, for example) in the hidden volume. If forced to disclose the password, then only the o…
I think on most operating systems the free space usually contains remnants of deleted files, not random data, unless you use some sort of secure deletion mechanism (srm, etc). If the free space of your volume contains truly random looking data then there would be reason to suspect a hidden volume.
Presumably that's not the case with TrueCrypt volume-within-a--volumes, but if you're using TrueCrypt there's already reason to suspect you might have hidden volumes.
It's impossible to prove the existence or nonexistence of hidden volumes, but that could be a good or bad thing depending on your adversary's willingness to jail/torture/kill you on suspicion alone.
I'm not aware of hidden volume software that integrates with "unsuspicious" file systems. Does something like that exist?
Re: TrueCrypt Master Key Extraction And Volume Identification
#29Earlier quoted context omitted.
I am not following you. Concealing? do you mean physically hiding the media on which it is stored? Like a flash chip in a tie clasp? If you mean concealing as in hidden partitions, data streams, or digital Stenography - these are all easily detectable upon close inspection. If there is extra bits where none are expected, this becomes a giveaway. Perhaps enough misdirection and a custom strategy of hiding could furthe…
TrueCrypt offers a volume-within-a-volume option. The free space of a volume normally contains random data, and the hidden volume is presumably headerless. The idea is then to put something that you might want to hide in the outer volume (freaky porn, for example), then put your actual secrets (evidence of your criminal enterprise, for example) in the hidden volume. If forced to disclose the password, then only the o…
This isn't a panacea. Check out what the dm-crypt folks have to say about it (question 5.2):
https://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQue...
tl;dr: even if your adversary can't "prove" you have another encrypted volume, when they can see all the random data on your disk or inside the "outer" volume, you can't prove you don't have an "inner" one. In a situation shitty enough that you're compelled to divulge incriminating secrets, you're boned whether you have another secret volume or not. Elsewhere in the FAQ they propose zeroing out unused space on your disk whenever travelling to totalitarian states that could demand decryption keys.
Re: TrueCrypt Master Key Extraction And Volume Identification
#30A naive person googling about TrueCrypt and stumbling on this article (well written with an authoritative tone) will think that TrueCrypt is completely cracked, and not bother to use it.
This research is interesting and useful, but do we really want to scare off people from using TrueCrypt?
Couldn't you add a paragraph at the top or to the side that says, for example:
"If TrueCrypt is used in the intended way, i.e., you finish your work with TrueCrypt, dismount the TrueCrypt volume, and then shut down your computer, then the data protected by TrueCrypt is secure if your computer is lost, stolen, or copied at that point."
I understand your intended audience (I'm one of them). But TrueCrypt is the best protection we've got (in terms of price (free), quality, license terms, multi-platform support, algorithm choice, etc.). I presume the author likes it and uses it himself too.
We want more people to use it, right? So let's at least make it clear that it isn't cracked or broken when used in the intended manner.