41–50 of 75 posts
Would it help to store a long string of data in memory, say 10mb. Then place the key somewhere in the middle of it? The placement could be based on the password. Just an idea..
A naive person googling about TrueCrypt and stumbling on this article (well written with an authoritative tone) will think that TrueCrypt is completely cracked, and not bother to use it. This research is interesting and useful, but do we really want to scare off people from using TrueCrypt? Couldn't you add a paragraph at the top or to the side that says, for example: "If TrueCrypt is used in the intended way, i.e.,…
If so, I'd say anyone who participates in Truecrypt's development is also intended audience.
The new era of encryption will be marked not by making existing encryption solutions more secure, but by concealing the very act of existence of encrypted data. "Here's my data but you cannot read it" - does not runs so well with courts, high stakes competitors and deep pocketed enemies. Once it is known "what to crack" the "how to" solution will be found. "Rubber hose cryptography" is one of these :) If you're not p…
By the way, this is exactly why the NSA will not catch many terrorists. You can always hide data and you can always hide communication (which is just data written and read by two different endpoints).
A naive person googling about TrueCrypt and stumbling on this article (well written with an authoritative tone) will think that TrueCrypt is completely cracked, and not bother to use it. This research is interesting and useful, but do we really want to scare off people from using TrueCrypt? Couldn't you add a paragraph at the top or to the side that says, for example: "If TrueCrypt is used in the intended way, i.e.,…
I just noticed that the author commented that he attempted to add some clarity to this effect.
Earlier quoted context omitted.
I am not following you. Concealing? do you mean physically hiding the media on which it is stored? Like a flash chip in a tie clasp? If you mean concealing as in hidden partitions, data streams, or digital Stenography - these are all easily detectable upon close inspection. If there is extra bits where none are expected, this becomes a giveaway. Perhaps enough misdirection and a custom strategy of hiding could furthe…
TrueCrypt offers a volume-within-a-volume option. The free space of a volume normally contains random data, and the hidden volume is presumably headerless. The idea is then to put something that you might want to hide in the outer volume (freaky porn, for example), then put your actual secrets (evidence of your criminal enterprise, for example) in the hidden volume. If forced to disclose the password, then only the o…
If we believe that torture would cause me to disclose the password of a file without a hidden volume, wouldn't it be just as effective at getting me to give the password to my hidden volume?
A naive person googling about TrueCrypt and stumbling on this article (well written with an authoritative tone) will think that TrueCrypt is completely cracked, and not bother to use it. This research is interesting and useful, but do we really want to scare off people from using TrueCrypt? Couldn't you add a paragraph at the top or to the side that says, for example: "If TrueCrypt is used in the intended way, i.e.,…
An advantage you gain right off the bat is that patterns in AES keys can be distinguished from other seemingly random blocks of data. This is how tools like aeskeyfind and bulk_extractor locate the keys in memory dumps, packet captures, etc. In most cases, extracting the keys from RAM is as easy as this: $ ./aeskeyfind Win8SP0x86.raw Shouldn't it be possible to store an AES key in a way that's indistinguishable from…
http://www.reddit.com/r/netsec/comments/1va904/truecrypt_mas...
Forgive a fool. But are the volatility plugins used (truecryptmaster and truecryptsummary) only provided to students of the official volatility training or is it released somewhere? Can't find it on their Google code page.