Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

True Goodbye: ‘Using TrueCrypt Is Not Secure’

krebsonsecurity.com

Post reply on HN
Print view View original

31–40 of 249 posts

Re: True Goodbye: ‘Using TrueCrypt Is Not Secure’

#31

Post by cornholio »

Truecrypt is dead, long live ChipCrypt: a Truecrypt fork with TRESOR and scrypt built in.

TRESOR is a technique that keeps the volume key strictly in the CPU registers and not in RAM. This completely prevents RAM freezing and related attacks. A running computer that is locked cannot be trivially decrypted anymore by dumping it's RAM.

Scrypt is an advanced password derivation function that makes even trivial passwords very hard to bruteforce. A scrypt derived key is 20000 times harder to crack than the equivalent PBKDF2 derived key of the same password.

The TrueCrypt license is not GPL compatible but it allows redistribution in source form as long as the software is not called "TrueCrypt".

Who's up for it ?

Re: True Goodbye: ‘Using TrueCrypt Is Not Secure’

#34

Post by dchest »

cornholio wrote: post #31

Truecrypt is dead, long live ChipCrypt: a Truecrypt fork with TRESOR and scrypt built in. TRESOR is a technique that keeps the volume key strictly in the CPU registers and not in RAM. This completely prevents RAM freezing and related attacks. A running computer that is locked cannot be trivially decrypted anymore by dumping it's RAM. Scrypt is an advanced password derivation function that makes even trivial passwords…

These two (TRESOR and scrypt) are incompatible, unless you allow for some time period where keys can be extracted. The point of scrypt is to be sequentially memory-hard: it mixes password and salt in a huge amount of RAM and makes it impossible to not use RAM for this operation.

Re: True Goodbye: ‘Using TrueCrypt Is Not Secure’

#35

Post by draugadrotten »

bak3dj0 wrote: post #30

Maybe the developers were Americans and they decided to bail before they get caught for exporting cryptographic software.

> Maybe the developers were Americans and they decided to bail before they get caught for exporting cryptographic software.

...or shutting down TrueCrypt was part of the plea-bargain. Either that or gitmo one way from the land of the formerly free.

alt.conspiracy.

Re: True Goodbye: ‘Using TrueCrypt Is Not Secure’

#36

Post by gambiting »

ambrop7 wrote: post #6

So what's the (Windows compatible and open source) software to transition systems to?

AS far as I am aware - there isn't one offering the same functionality.

Which is what makes it scary, because people all over the world are now left with much less user-friendly choices for encryption.

Re: True Goodbye: ‘Using TrueCrypt Is Not Secure’

#38

Post by andyjohnson0 »

danparsonson wrote: post #27
grrowl wrote: post #21

Earlier quoted context omitted.

I don't believe BitLocker can be considered secure. Cross-post (mine) from the previous thread: > Not "backdoors" but it seems Microsoft stores the BitLocker decryption key, based on this leaked slide (just found on twitter): https://twitter.com/TheBlogPirate/status/471759810644283392/... > edit: Confirmed Microsoft stores your recovery key on their servers if you're not connected to a domain: http://windows.microsof…

> Not "backdoors" but it seems Microsoft stores the BitLocker decryption key, based on this leaked slide (just found on twitter): https://twitter.com/TheBlogPirate/status/471759810644283392/... . That looks dubious to me - if you were creating a slide, would you use 90-degree-rotated text? > edit: Confirmed Microsoft stores your recovery key on their servers if you're not connected to a domain: http://windows.microso…

Using a Microsoft account for login is not mandatory on Windows 8.

Re: True Goodbye: ‘Using TrueCrypt Is Not Secure’

#39

Post by [deleted] »

pling wrote: post #22

Well this is good for me. I currently use a TrueCyrypt encrypted exFAT volume for backups. My motivation is now to move this to an open source system (probably dm-crypt). This and RDP is the only reason I'm hanging onto windows and that's purely out of apathy. The suggestion of using BitLocker is a bit insulting (this might just be comedy value from TC though). Every other bit of software I use is portable or in a Li…

[deleted]

Re: True Goodbye: ‘Using TrueCrypt Is Not Secure’

#40

Post by cornholio »

dchest wrote: post #34
cornholio wrote: post #31

Truecrypt is dead, long live ChipCrypt: a Truecrypt fork with TRESOR and scrypt built in. TRESOR is a technique that keeps the volume key strictly in the CPU registers and not in RAM. This completely prevents RAM freezing and related attacks. A running computer that is locked cannot be trivially decrypted anymore by dumping it's RAM. Scrypt is an advanced password derivation function that makes even trivial passwords…

These two (TRESOR and scrypt) are incompatible, unless you allow for some time period where keys can be extracted. The point of scrypt is to be sequentially memory-hard: it mixes password and salt in a huge amount of RAM and makes it impossible to not use RAM for this operation.

I would say "complementary" not "incompatible". Once you have derived the key you can clear the RAM and keep the key on the CPU chip only. So there's a vulnerability window of a few seconds during which the key (or key related material) is stored in RAM, after which it can no longer be recovered.

In sharp contrast with regular TrueCrypt where the master volume key is stored in RAM all the time. It's already standard operating procedure for law enforcement to time raids when the computers are in use and make a dump of the machine RAM.

Post reply on HN