Live data from Hacker News

TrueCrypt Master Key Extraction And Volume Identification

volatility-labs.blogspot.com

71–75 of 75 posts

Re: TrueCrypt Master Key Extraction And Volume Identification

#71
post #57

Are there any 'better' (knowing it's all relative) alternatives for what TrueCrypt provides?

Nothing remotely as peer-reviewed and time-tested and open-source.

http://istruecryptauditedyet.com/

This suggests that e.g. dm-crypt is definitely more "open-source", and may in fact be better audited. I guess TC is still more "time-tested".

Re: TrueCrypt Master Key Extraction And Volume Identification

#73
post #69

Earlier quoted context omitted.

That's always been impossible.

Not always (as long as you're talking about something they are in possession of, you're right if you mean you can't prove that you don't have some flash drive hidden somewhere but, then again, it need not be encrypted if they don't have access to it). To start simply, it's certainly possible to prove that a disk installed with a base install of an OS (and then never touched) contains no encrypted volumes if all of th…

If I remember correctly, when you buy a blank hard drive, and then format it, the formatting tool does not zero out the entire partition. The empty space left after a base install of an OS is note literally all zeroes or ones, it's random noise.

Am I wrong or outdated on this?

Re: TrueCrypt Master Key Extraction And Volume Identification

#74
post #69

Earlier quoted context omitted.

That's always been impossible.

Not always (as long as you're talking about something they are in possession of, you're right if you mean you can't prove that you don't have some flash drive hidden somewhere but, then again, it need not be encrypted if they don't have access to it). To start simply, it's certainly possible to prove that a disk installed with a base install of an OS (and then never touched) contains no encrypted volumes if all of th…

I think that knowability is one place where it pays to be careful and pedantic.

So in that framework "stored somewhere" is a long ways from "You can characterize the contents of a known drive".

Re: TrueCrypt Master Key Extraction And Volume Identification

#75
post #72
post #64

Earlier quoted context omitted.

Why? Do you have any reference?

Here's a paper on the subject http://www1.cs.fau.de/filepool/projects/coldboot/fares_coldb...

Note the comment at the end of the paper. The authors had not been able to do it successfully with their relatively simple methodology. Sure it is harder than DDR2 but this doesn't mean it is impossible. As pointed out by the authors, the failure can simply be due to the memory controller implementation (or DDR3 protocol itself) on their test setup. If this is the case, then all it takes is a custom memory controller that is optimized for this type of extraction.
Post reply on HN