The new era of encryption will be marked not by making existing encryption solutions more secure, but by concealing the very act of existence of encrypted data. "Here's my data but you cannot read it" - does not runs so well with courts, high stakes competitors and deep pocketed enemies. Once it is known "what to crack" the "how to" solution will be found. "Rubber hose cryptography" is one of these :) If you're not p…
Interestingly, this is something Julian Assange worked on several year before starting Wikileaks: Starting around 1997, he co-invented the Rubberhose deniable encryption system, a cryptographic concept made into a software package for the Linux operating system designed to provide plausible deniability against rubber-hose cryptanalysis;[68] he originally intended the system to be used "as a tool for human rights work…
TrueCrypt Master Key Extraction And Volume Identification
31–40 of 75 posts
Re: TrueCrypt Master Key Extraction And Volume Identification
#32Earlier quoted context omitted.
TrueCrypt offers a volume-within-a-volume option. The free space of a volume normally contains random data, and the hidden volume is presumably headerless. The idea is then to put something that you might want to hide in the outer volume (freaky porn, for example), then put your actual secrets (evidence of your criminal enterprise, for example) in the hidden volume. If forced to disclose the password, then only the o…
This isn't a panacea. Check out what the dm-crypt folks have to say about it (question 5.2): https://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQue... tl;dr: even if your adversary can't "prove" you have another encrypted volume, when they can see all the random data on your disk or inside the "outer" volume, you can't prove you don't have an "inner" one. In a situation shitty enough that you're compelled to di…
> they propose zeroing out unused space on your disk whenever travelling to totalitarian states that could demand decryption keys.
Like the UK: http://arstechnica.com/tech-policy/2007/10/uk-can-now-demand...
Re: TrueCrypt Master Key Extraction And Volume Identification
#33The new era of encryption will be marked not by making existing encryption solutions more secure, but by concealing the very act of existence of encrypted data. "Here's my data but you cannot read it" - does not runs so well with courts, high stakes competitors and deep pocketed enemies. Once it is known "what to crack" the "how to" solution will be found. "Rubber hose cryptography" is one of these :) If you're not p…
Implementations of crypto, such as Truecrypt, rely on algorithms/ciphers such as AES which (in some modes) basically appears random... But the appearance of randomness is not enough if someone is convinced there is meaningful data there. Of course, a break such as "we can tell if there's a hidden truecrypt volume" is bad, and if I recall correctly there are ways of doing this now. You'd need to basically never transm…
Or, transmit random data on a schedule indistinguishable from the actual data, I suppose.
Re: TrueCrypt Master Key Extraction And Volume Identification
#34Would it help to store a long string of data in memory, say 10mb. Then place the key somewhere in the middle of it? The placement could be based on the password. Just an idea..
Re: TrueCrypt Master Key Extraction And Volume Identification
#35A naive person googling about TrueCrypt and stumbling on this article (well written with an authoritative tone) will think that TrueCrypt is completely cracked, and not bother to use it. This research is interesting and useful, but do we really want to scare off people from using TrueCrypt? Couldn't you add a paragraph at the top or to the side that says, for example: "If TrueCrypt is used in the intended way, i.e.,…
We want more people to use it intelligently. If they're not capable of understanding the implications of this research, are they really going to be able to use this software effectively? How much hand holding do we need to do, here?
Re: TrueCrypt Master Key Extraction And Volume Identification
#36Would it help to store a long string of data in memory, say 10mb. Then place the key somewhere in the middle of it? The placement could be based on the password. Just an idea..
It seems like that would be extremely easy to brute force.
Re: TrueCrypt Master Key Extraction And Volume Identification
#37A naive person googling about TrueCrypt and stumbling on this article (well written with an authoritative tone) will think that TrueCrypt is completely cracked, and not bother to use it. This research is interesting and useful, but do we really want to scare off people from using TrueCrypt? Couldn't you add a paragraph at the top or to the side that says, for example: "If TrueCrypt is used in the intended way, i.e.,…
We want more people to use it intelligently. If they're not capable of understanding the implications of this research, are they really going to be able to use this software effectively? How much hand holding do we need to do, here?
> How much hand holding do we need to do, here?
A lot more than is currently the standard.
Security is a horribly complex subject, and the people that need it most often don't have the time or knowledge to judge tools and sort out implementation details.
Re: TrueCrypt Master Key Extraction And Volume Identification
#38A naive person googling about TrueCrypt and stumbling on this article (well written with an authoritative tone) will think that TrueCrypt is completely cracked, and not bother to use it. This research is interesting and useful, but do we really want to scare off people from using TrueCrypt? Couldn't you add a paragraph at the top or to the side that says, for example: "If TrueCrypt is used in the intended way, i.e.,…
Acknowledged - I added a few words about this to the end of the post.
Re: TrueCrypt Master Key Extraction And Volume Identification
#39Earlier quoted context omitted.
Implementations of crypto, such as Truecrypt, rely on algorithms/ciphers such as AES which (in some modes) basically appears random... But the appearance of randomness is not enough if someone is convinced there is meaningful data there. Of course, a break such as "we can tell if there's a hidden truecrypt volume" is bad, and if I recall correctly there are ways of doing this now. You'd need to basically never transm…
Or, transmit random data on a schedule indistinguishable from the actual data, I suppose.
Hence numbers stations: http://en.wikipedia.org/wiki/Numbers_stations
Re: TrueCrypt Master Key Extraction And Volume Identification
#40 An advantage you gain right off the bat is that patterns
in AES keys can be distinguished from other seemingly
random blocks of data. This is how tools like aeskeyfind
and bulk_extractor locate the keys in memory dumps, packet
captures, etc. In most cases, extracting the keys from RAM
is as easy as this:
$ ./aeskeyfind Win8SP0x86.raw