in Truecrypt 437 Words

An update on Truecrypt

Several people have been asking for an update on our public audit of the Truecrypt disk encryption software. I’m happy to say that the project is on track and proceeding apace. Here I wanted to give a few quick updates:

  1. Thanks to the amazingly generous donations of 1,434 individual donors from over 90 countries, as of today, we’ve collected $62,104 USD and 32.6 BTC* towards this effort. This is an unbelievable response and I can’t thank our donors enough. I’m blown away that this is happening.
  2. We’ve assembled a stellar technical advisory board to make sure we spend this money properly and generally to keep us honest. More details shortly.
  3. In order to make best use of the donated funds and manage on-going governance of the project, we’ve incorporated as a non-profit corporation in North Carolina—the Open Crypto Audit Project (OCAP)—and are currently seeking 501c(3) tax-exempt designation. Board members include myself, Kenn White (who has been doing most of the heavy organizational lifting) and the amazing Marcia Hoffman. We have high hopes that OCAP will find a purpose beyond this Truecrypt audit.
  4. The Open Technology Fund has generously agreed to donate a substantial amount of contracted evaluation time to our effort
  5. And finally, the most exciting news: we’ve signed a first contract with iSEC partners to evaluate large portions of the Windows software and bootloader code. This review will begin in January.
Despite the progress above, there’s still a lot of work to do. The iSEC review will cover a lot of the thorniest bits of the code, but we are still working to audit the core cryptographic routines of Truecrypt and move the project onto a secure (deterministic) build footing. We hope to have further announcements in the next few weeks.

Let me add one more personal note.

I usually take a pretty skeptical attitude on this blog when it comes to Internet security. For the most part we do things wrong, and I used to think most people didn’t care. The fact is that I was wrong. If the response to our audit call is any evidence, you do care. You care a lot.

Donations (click to enlarge)

I can’t tell you how amazed I am that any of this is happening. As far as I know, this is the first time that the Internet has come together in this way for the purposes of making us all a bit safer. I hope it’s the beginning of a trend.

More updates to come.

* Incidentally, determining the dollar value of BTC is fun, fun fun. We’ve been trying to responsibly sell these at the ‘best’ price. But, ugh.

27 thoughts on “An update on Truecrypt”

  1. > * Incidentally, determining the dollar value of BTC is fun, fun fun. We've been trying to responsibly sell these at the 'best' price. But, ugh.

    This is interesting; can you provide some insight as to why you want to sell the donated BTC?

  2. Why wouldn't you? Most people don't accept Bitcoin as a valid form of payment, and for good reasons (hint: one very big reason is in the first sentence you quoted).

  3. Timing the market doesn't work well as a general strategy, I don't see any reason to think there's anyone that can do it for BTC.

    And assuming that's not possible, my thought would either be dollar cost averaging in reverse – sell $5000 worth of BTC every Monday (or whatever) until it's gone. Or just cross your fingers and sell at the current market price and don't second guess yourself.

  4. Why are you incorporating in America? If you found a large section of code commented “NSA put this here” (proverbially, of course), the NSA could threaten you with jail-time or worse for revealing it. Shouldn't you incorporate somewhere that respects internet freedom… (like Mars, perhaps 😦 )

  5. The BTC isn't for their personal use, and the companies they're going to be working with probably prefer to be paid in cash, not cryptocurrency.

  6. The people are in the US, the money is in the US. incorporating in another country wouldn't change that situation at all, it'd just make it look like a tax shelter.

  7. any thoughts on supporting FOSS projects that can create and manage truecrypt formatted encrypted volumes?[1][2][3]

    truecrypt encrypted volume format is known,why not work on alternatives that can create and open truecrypt volumes along side verifying truecrypt code? If truecrypt code can not be trusted,then the next best thing is to have alternatives to it that can manage truecrypt volumes for compatibility.

    [1] https://github.com/bwalex/tc-play
    [2] http://code.google.com/p/cryptsetup/
    [3] http://code.google.com/p/zulucrypt/

  8. While bitcoin is not usually accepted by the general population as a form of payment, people who do security- and cryptography-related work are often interested in bitcoin and accept it as a form of payment. Please consider paying in bitcoin directly.

  9. I find it rather ironic that the Open Technology Fund claims to fight against illegitimate surveillance, but their entire existence is the result of the US, the NSA and the CIA.

  14. Since this project is basically a trust-based endeavor, and you have selected a US Company (iSEC) to do the code review – a commercial outfit that may be subjected to all kinds of “polite requests” from various agencies – it might be prudent to at least ask them to post a warrant canary on the project page and to certify each report that no external offers, requests, or demands have taken place.

  15. Anon, the NSA is not a law enforcement agency. It's not the FBI (arrest) or Department of Justice (prosecution), it can't itself threaten anyone with prison.

    Besides that, anything that OCAP or iSEC finds and releases would be protected by the first amendment in the United States, a protection that many other countries don't have. (Ask The Guardian about that.)

    NSA might begin surveillance of OCAP (if it hasn't already), but that's just about all it can do.

  17. having multiple implementations of the same thing is a form of “auditing” since “cover ups” will show up from incompatibilities with other implementations.Unless if you think all these projects are a part of the conspiracy to hide the truth,then again,what then would be the point of all this exercise this post is talking about?they could also be part of the cover up.

  18. You should use a warrant canary to let us know that you haven't been told not to reveal a flaw you find.

  19. I disagree that simply having multiple independent implementations is a form of, or a substitute for auditing code. It's no guarantee that all implementations are correct, much less secure. They could all be flawed, even unintentionally. It's not any kind of conspiracy theory and coverup is required for people to make mistakes independent of each other.

    The only way to know if code is secure is to audit it, ideally multiple times, so the real question is which product is more deserving of the available resources. It's kind of a moot question though since funds were raised for this project based on the promise that TrueCrypt would be audited, not tc-play or one of these others.

    Given it's feature set and usage base, TC would probably be the best choice anyway.

  20. Not wishing to go into a debate with you on this so i just though i should add what is below for those who may be interested on mentioned project's and how they work.

    There are two things as far as truecrypt is concerned,there is the truecrypt encrypted volume format and truecrypt binary program that has internal implementation of crypto necessary to parse the encrypted format and encryption and decryption of data to and from disk.

    The format is known and those mentioned projects do create/parse it.These projects have a dependency on libgcrypt or openssl as providers of crypto routines that are necessary in parsing the volume format.

    Once the format is parsed to obtain necessary information to create kernel managed encryption mappers,the information is passed to the kernel infrastructures that deals with block device encryption and the kernel is the one responsible for encryption and decryption of data to or from the disk.

    So as far as crypto routines are concerned in these projects,you are talking about crypto routines in kernels and projects like libgcrypt or openssl and i think these projects are trusted and have been scrutinized enough.

    TrueCrypt in linux gives an option to use their crypto or linux kernel's crypto.Tcplay uses linux kernel crypto in linux and bsd kernel crypto in BSD.If somebody can be bothered to parse truecrypt volume format in windows,it should be possible to use window's crypto to do block device encryption on truecrypt formatted volumes or the same in OSX.

    Its possible all these block device crypto routines are flawed in the same exact way masking the problem but its highly unlikely and if it is so,the auditors could too,make the same mistake continuing the masking of the problem.

  21. As one of the contributors, I want to thank you and everyone else working on this as well as my fellow contributors. I look forward both to the results of the audit and to the possibility that you may be able to create an organization and a process to do this kind of work on an ongoing basis. On a final, somewhat less pleasant note: As you are no doubt aware, a large measure of trust (not to mention money) has been given to the collective “you” by people who have had their trust and money abused in the past. Please, please, please ensure that everything the collective “you” does is beyond reproach — and is seen to be beyond reproach — even if it takes longer and costs more. The success or failure of this endeavor actually has nothing to do with TrueCrypt at all; but rather with the possibility of trust and integrity in public life in general and with technology in particular. Good Luck!

  25. Of course people do it with BTC. A lot of people sold at $1200 when the bad China news came out.

  26. It is amazing. So a lot of people around the world donated some money, and we learn now that the code will be audited by US organizations / companies.

    As an European citizen, I am very upset. Will people learn? US cannot be trusted anymore, including “independent” organisations.

  27. Condemning a whole country due to the actions of a few? Apparently, using that logic, the whole of Europe is populate with idiots. Fascinating.

Comments are closed.