Tag Archives: whole disk encryption

Analysis: Is there a backdoor in Truecrypt? Is Truecrypt a CIA honeypot?

Posted on by

Truecrypt domain registed with a false address

The domain name “truecrypt.org” was originally registered to a false address (“NAVAS Station, Antarctica”), and was later concealed behind a Network Solutions private registration.

Truecrypt developers identity hidden

The TrueCrypt developers used the aliases “ennead” and “syncon”, but later replaced all references to these aliases on their website with “The TrueCrypt Foundation” in 2010. The TrueCrypt trademark was registered in the Czech Republic under name of “David Tesařík”.

Nobody knows anything about the developers, they do not want to identify themselves. Everyone likes to be known and congratulated for their great work, but apparently not Truecrypt developers, they do not care about the glory and honour and all that comes with it.

Truecrypt developers working for free

Closed source full disk encryption competitors like WinMagic, DriveCrypt (Securstar) and PGP Corporation have a full time team of software developers working in their products, creating such a product is not an easy feat as any of them will tell you.

Meanwhile two unpaid Truecrypt developers manage to work on Linux, MAC and Windows versions, on 32 and 64 versions and support the next Windows 7 as soon as it has been released, at the same time, presumably, these two Truecrypt developers also hold full time jobs that pays them a salary to feed their families and covers their mortgages .

Are closed source full disk encryption software developers overpaid lazy bastards and Truecrypt developers the finest, most hard working and charitable software developers on Earth?

Compiling Truecrypt source code increasingly difficult

Very few people compile the Windows binaries from source; it is exceedingly difficult to generate binaries from source that match the binaries provided by Truecrypt (due to compiler options, etc.)

This would be very convenient for a CIA mole, they are more likely to attack the software implementation other than the algorithm and the best way to do that is to insert some hard to find vulnerability during packaging. If someone else compiled the source code their plan would not work.

Truecrypt license contains distribution restrictions

Truecrypt is released under its own “Truecrypt license”, it is open source but it contains distribution and copyright-liability restrictions, most major Linux distributions do not want to know anything about it, Fedora has included TrueCrypt in its forbidden items list and forked it to RealCrypt instead.

Reference: http://fedoraproject.org/wiki/ForbiddenItems#TrueCrypt

UPDATE 2011: Truecrypt removed from The Amnesic Incognito Live system

The developers of the anonymous live CD called Tails have now decided to remove Truecrypt from their distribution claiming that development is done in a closed fashion, the licensing is restrictive and it is not being reviewed by too many people.

Reference: http://tails.boum.org/support/truecrypt/index.en.html

Truecrypt open source code has never been reviewed

Truecrypt’s source code has never been the subject of a thorough review, nor is there any reason to rely on the credentials of the developers, since they remain anonymous.

Good thorough code review and testing is hard, tedious and painstaking work, very few people have the skills to do it, and Truecrypt hasn’t been validated through a comprehensive review by any qualified cryptographer.

Censorship at Truecrypt forums

As per Truecrypt forum rule 3 you are not allowed to discuss about other encryption software, as per Truecrypt forum rule 8 you can’t discuss Truecrypt forks, as per Truecrypt forum rule 9 you can’t discuss software that decrypts Truecrypt.

You can’t say anything about their competitors and you are not even allowed to say anything about software that decrypts Truecrypt. If you post any criticisms or negative comments about their software, you will find that those posts will mysteriously disappear.

Truecrypt forum rules: http://forums.truecrypt.org/viewtopic.php?t=1651

Can the FBI crack Truecrypt?

The CIA would never share their intelligence with their FBI puppies unless it is a real national security matter, terrorism, et al. And they would not want to kill the cow that produces their milk in a public trial where their capabilities are revealed.

Furthermore, there has been recently a case of a corrupt Brazilian banker who has escaped prosecution after the FBI failed to break his fully encrypted disk, he was using Truecrypt.

Reference: https://secure.wikimedia.org/wikipedia/en/wiki/Daniel_Dantas

Given those news I do not believe the FBI can crack Truecrypt and unless your name is Bin Laden you are probably still safe with Truecrypt, even if it has a backdoor and the FBI seizes your computer.

Alternatives to Truecrypt forums

Computer security and privacy newsgroups such as alt.privacy.anon-server ; alt.security.pgp , alt.privacy and alt.scramdisk

Computer and security internet forums such as Wilders Security Forums.

Alternatives to Truecrypt

The only free full disk encryption open source software that I have found and can rival Truecrypt is Diskcryptor.

Conclusion about Truecrypt reliability

Don’t get paranoid, even if you are using Truecrypt I could as well be wrong on my analysis and it is highly unlikely the CIA will ever come after you anyway.

Everyone has something to hide, but take it easy,you will need to trust some encryption product in the end and nobody out there knows 100% sure which one is safe, because what is safe today might not be tomorrow.

Just use the best encryption product according to your opinion and relax, there is no point in keeping in your head what could happen to you if you got it wrong, hopefully you did not, and as long as you did your best research on it, that is all that is needed.

For the record, I still recommend Truecrypt, they are my second choice of full disk encryption software after DiskCryptor. I am just raising what I believe are some fair points, because in security, you TRUST NOBODY.

Review: Full disk encryption DiskCryptor v0.7.435.90

Posted on by

Most of you will have heard of Truecrypt, a free an open source hard disk encryption product, there are only another free and open source software for full disk encryption in Windows that I am aware of, DiskCryptor. You can download a 32bit or 64bit version of Diskcryptor depending on your OS.

I tested DiskCryptor using it for full disk encryption of my netbook, an Asus PC901 with a 12GB HDD divided in between two solid state disks of 8GB and 4GB. DiskCryptor is an ideal alternative to encrypt a netbook because netbooks do not have a CD drive and Truecrypt will force you to burn a CD to use system encryption, which DiskCryptor does not.

DiskCryptor cascade algortyhms
DiskCryptor cascade algortyhms

The first thing that impressed me of DiskCryptor is how small it is in size, a little over 500KB, but this comes at a price since the software manual does not come along and you get a link to their website instead.

I was pleased to see DiskCryptor offering a wide choice of encryption algorythms, AES-256, Twofish or Serpent algorithms in XTS mode, all of them seem to be pretty sound algorythms to me, and they can be used on cascade mode as well, VIA Padlock hardware accelaration for encryption and hashing is supported too.

The built-in benchmark shows the top speed with which cryptographic algorithms can perform, but I have to tell you that even on a netbook with a single core Intel Atom processor, regardless of the encryption algortyhm used I noticed no perfomance difference while using the netbook.

DiskCryptor encryption of partition
DiskCryptor encryption of partition

DiskCryptor allows wipe while encrypting, with three, seven or thirty five passes (Guttman method), but wiping a solid state disk like the one Asus Eee PC901 has is not safe, since solid state disks, like thumb drives, use wear levelling technology and the wiping passes are spread evenly accross the disk and not on the same sectors. If you are using a solid state disk, make sure it does not contain any confidential data that an electrons microscope could recover(very expensive to do right now), the only way to do this is by using a new disk, wiping it may fail to sanitize de disk.

With DiskCryptor you also can encrypt an ISO file and then burn it to CD-R/DVD/BD-R , after that you  will only be able to mount the image with DiskCryptor and the correct password/keyfile.

You can also set up a hot key to cause a blue screen of death, if you need to urgently shut down your computer when someone busts into your home unexpectedly this seems the way to go, it is quicker than clicking on the power off button.

The Good Stuff

DiskCryptor works with RAID volumes, you get a wide choice of algorythms, DiskCryptor is easy to use and unlike Truecrypt, it works on netbooks out of the box. DiskCryptor is open source, you can check for backdoors if you have the skills.

The software does not cost you any money, you can customize the boot loader widely, DiskCryptor boot loader customization is far better than Truecrypt, you can choose to install the bootloader on a CD/DVD, set up timeouts, choose if you want to use a QUERTY or DVORAK keyboard, and there is also a Windows live CD BartPE plugin for DiskCryptor.

The Bad Stuff

DiskCryptor should include some basic documentation at the very least, the GUI is easy to use and intuitive but encryption products need to come with instructions, a newbie could easily feel overwhelmed. DiskCriptor is only available for Windows, and there is no choice of hashing algorythms other than the default SHA-512.

There is also no choice of burning a recovery CD in case the boot loader gets corrupted (although you can backup the headers).

DiskCryptor password enter box
DiskCryptor password box

Conclusion

DiskCryptor is an excellent free and open source full disk encryption  alternative to Truecrypt, with a wide choice of encryption algorythms and easy to use, but they need to improve their poor documentation.

Their FAQ states that they are planning to implement a hidden OS in future versions, I think Diskcryptor looks promising and Truecrypt has a worthy competitor.

http://www.diskcryptor.net

Video: How to, encryption with PGP 9 Desktop

Posted on by

This is an introduction video for begginers, if you have never seen or heard of PGP Desktop, this video explains briefly in 5 minutes what it can do for your privacy.

If you want to keep all your computer data encrypted, including the OS, after Truecrypt and Drivecrypt Plus Pack , PGP Desktop would be my third choice. As far as I know all three of them are uncrackable, even by the highest powers out there. But bear in mind that it is illegal in the United Kingdom not to reveal your password to your encrypted files when requested by the authorities.

PGP 9 will not protect you against a Government forcing you to give away the password for your personal secrets, you should be using Truecrypt or Drivecrypt Plus Pack if you think this may happen to you. Both of those encryption schemes provide for a hidden operating system which existence can not be proven, you can not be asked to provide what can not be proven to exist.

If you are comparing encryption software you can read my past  review of Drivecrypt Plus Pack v3.94

Review: Drivecrypt Plus Pack v3.95, full disk encryption

Posted on by

Some people out there are antagonistic to encryption software that is not open source and can not be reviewed for backdoors. Drivecrypt Plus Pack is one such proprietary encryption product.

There maybe some reason why you may want to use it, for example some special feature of compatibility issues. I decided to download Drivecrypt Plus Pack after Truecrypt 6.1a started to give me problems at boot up time.

DriveCrypt Plus Pack full disk encryption has very few things in common with Truecrypt in relation to usability and functions, if you are a former Truecrypt user you will need to read the DCPP manual to understand some terms and features not present in Truecrypt.

DriveCrypt Plus Pack v3.94 Install

DriveCrypt Plus Pack v3.94 Install

DriveCrypt Plus Pack allows you to secure your disk, including removable media, with a powerful and proven encryption algorithm (AES-256), AES-256 is a FIPS approved symmetric encryption algorithm.

DriveCrypt Plus Pack main features:

- Full disk encryption, encrypts 100% of your hard disk including the operating system.

- Pre-boot authentication, before the machines boots a password is requested to decrypt the disk and start your machine.

- It can create an encrypted hidden operating system which existence can be denied, this is useful if you are ever forced to give out your password.

- Strong 256bit AES encryption

- Optional USB-Token authentication at pre-boot level

Before you start encrypting your disk you must install what DCPP calls BootAuth, this is the Master Boot Record, if you attempt to encrypt the disk without BootAuth you will be stopped and a message will warn you.

The Good Stuff

Once you are registered with Securstar website you will have access to video tutorials online about how to use DriveCrypt Plus Pack.

DCPP allows the use of a USB key as a password, but if you think that the Stasi or any other repressive government agency can raid your home, you will be better off memorasing your passphrase.

Drivecrypt Plus Pack has specific administator/user rights, ideal for corporations and multiuser computers.

The master password to access the encryption keys held in your keystore can be hidden in pictures (.bmp) or sounds (.wav) using steganography.

You can set up a logon password that when entered will destroy the BootAuth, deleting the bootloader and making the disk unbootable. To use this against a repressive regime avoiding being accussed of obstruction to justice you can write the destruction password down next to your computer with the word “password” on it, and the Stasi will enter it for you in their computer forensics laboratory, destroying the bootloader themselves.

DriveCrypt Plus Pack comes with various BootAuth, this is how DCPP names the logon screen, one of them consists of a black BootAuth with the message “Hard disk failure”. It will not fool a computer forensics expert but can be optimal to fool your noisy flatmate.

DriveCrypt Plus Pack manual also explains how you can create your own customized logon screen with an image editor.

Securstar, the company selling Drivecrypt Plus Pack, accepts payments by check, Paypal, credit card or bank transfer. There is a Windows Vista 64 bit version available as well as the most widely used 32 bit.

You can test the integrity of the encryption method with a small utility included in Drive Crypt Plus Pack.

You can assign a hotkey to lock your computer if you have to go away from your computer for a few moments, this will activate a password protected screensaver.

If you have any problem or query Securstar provides support via email.

DriveCrypt Plus Pack Keystorage

DriveCrypt Plus Pack Keystorage

The Bad Stuff

The software is propietary, nobody can access the source code and it only works in Windows.

Drive Crypt Plus Pack help file and instuctions are poor and not detailed enough,  the Red Screen and BootAuth destruction features in particular are poorly documented.

Their official online support team, although replying quickly, in my experience, are not too knowledgeable of the product.

Raid and dynamic disks are not supported, normally this should not be a problem for home users, only for businesses, it may still work but Securstar does not support it.

You can not use the non hidden operating system normally, only have it created in case you are forced to reveal the password.

A computer forensics investigator will be able to find out the last time you accessed that non hidden operating sytem by looking at the file timestamps.

Notice that Truecrypt hidden operating system feature also has the same problem, as the predicament arises from Windows itself,  download Mr. Bruce Schneir Defeating Deniable Encrypted File Systems research paper for more info on this.

You will need internet access to register the software.

Conclusion

Assuming you trust closed source full disk encryption software DriveCrypt will be a great choice. Unlike other similar commercial software like PGP whole disk encryption, DCPP has some features ideal for home users.

Some examples are: Creating an operating system which existance can not be proved, capability to destroy BootAuth entering a determined password to make the disk unbootable, use of steganography to hide your encryption keys inside a picture or sound file, realistic hard disk failure logon black screen and the possibility of creating your own preboot screen with a simple photo editor.

Truecrypt vs. DriveCrypt Plus Pack:

DriveCrypt Plus Pack is a commercial venture and can not compete in price against Truecrypt, which is free.

Truecrypt source code can be checked for backdoors and reliability (although to the best of my knowledge nobody qualified has looked into its source code yet and said it is safe).

DriveCrypt Plus Pack has a support team that will help you in case of problems, Truecrypt has not.

DriveCrypt Plus Pack has some extra features like customizing of boot up screen, hiding of encryption keys for the keystore through steganography and USB authentication token support.

Truecrypt works in Linux as well as Windows, if you encrypt an external hard disk with Truecrypt in Windows you can then open that encrypted disk with your Linux computer.

DriveCrypt Plus Pack does not force you to burn a CD before you install the software, this is my greatest grunge against Truecrypt developers. See my work around to install Truecrypt on a computer without CD drive if you want to install Truecrypt on your netbook.

Truecrypt instructions manual is first rate, and I think everyone should read it even if they do not use Truecrypt. Not only it contains help about their product but it also explains how you should tweak Windows to avoid data leaks. Truecrypt also has a wider choice of encryption algorythms than DriveCrypt Plus Pack, but DCPP AES256 is considered a standard and this is the one I would use with any encryption program.

DriveCrypt Plus Pack BootAuth in hidden mode

DriveCrypt Plus Pack BootAuth in hidden mode

PS:

Whole disk encryption booting up problem solved!

I have experienced this with Truecrypt and DriveCrypt Plus Pack, this is not a software issue, it can happen with ANY whole disk encryption program.

Your computer hard disk will spin non stop and you will see this message on the screen while booting up your computer:

>Verifying DMI pool data…
>Boot from CD:
>Disk boot failure, insert system disk and press enter

This is a BIOS problem, as far as I know there is no easy solution other than getting into the BIOS and disabling the booting from CD option, you should be able to do this on any modern BIOS. If you then one day need to boot from a CD-Rom you will need to enable this option again.

Installing Truecrypt 6.1a on a computer without CD drive

Posted on by

If you want to have whole disk encryption on your netbook you will be dissapointed with Truecrypt because unless you burn a .iso on a CD first, Truecrypt will not allow you to encrypt your drive, but there is a way around this, it worked for me so it should do it for you too.

Download software that will mount your .iso CDs virtually , I used Alcohol120,  this is not free, but the trial version worked well,  the only problem I had was finding out how to mount the virtual CD with Alcohol120 as I didnt really want to waste half day reading the manual. Once you mount your virtual .iso CD created by Truecrypt you are ready to go, Truecrypt will allow you to encrypt your whole Netbook Windows operating system as normal.

You can  also use Daemon Tools to emulate the mounting of your Truecrypt recovery disc virtually.

Asus eee pc 901

Asus eee pc 901

This is what the Truecrypt recovery disk looks like once mounted through a virtual drive using Alcohol:

Truecrypt revocovery disk mounted through a virtual drive
Truecrypt revocovery disk mounted through a virtual drive

You can also use this trick to avoid wasting a CD-Rom while installing Truecrypt on your desktop computer, it is pretty sad that Truecrypt developers are  not allowing people to make their own choices and making the creation of an emergency recovery disc compulsory.