TrueCrypt is Dead, Long Live TrueCrypt!

March 29, 2014
| No Comments

Update: TrueCrypt is Dead, Long Live TrueCrypt!

Although no new news have come out of truecrypt.org there has been much speculation and commenting on the disappearance of TrueCrypt. Some speculation states the the original message on the TrueCrypt website itself was an indication that the NSA now controls the product in some way. See pastebin article.

  1. The message on TrueCrypt’s new website got me thinking:
  2. Using TrueCrypt is not secure as it may contain unfixed security issues
  4. Let’s isolate the first letter of each word:
  5. (U)sing (T)rueCrypt (i)s (n)ot (s)ecure (a)s (i)t (m)ay (c)ontain (u)nfixed (s)ecurity (i)ssues
  7. Result?
  8. utinsaimcusi
  10. Let’s spread that!
  11. uti nsa im cu si
  13. That is latin for
  14. “If I wish to use the NSA”
  16. Stay away from future Truecrypt releases. This is clearly a warning from the developers.

One of the best assessments on the subject however is an article found on GRC.com. This correctly states that the original TrueCrypt 7.1a code base has not changed since Feb 2012, so if you have that specific version (that has not been altered), why is there cause for panic. Just make sure you verify the hash of the original downloaded package and continue to use TrueCrypt without worries. Read the full article here.

Additionally the TrueCrypt 7.1a code base has gone through a lot of independent auditing. The project launched by Matthew Green in Oct 2013 aims to audit the project, and they have made big strides. istruecryptauditedyet.com. The initial audit can be found here.

Additional resources of interest includes:

The long and the short of the story is that TrueCrypt is not dead yet, apparently not by a long short. The future of develop is still uncertain, but some would-be owners have appeared to try and keep the project alive. See truecrypt.ch for more.

 

 

Apparently the developers of TrueCrypt have called it a day, and I must say I am truly sad about that. This week saw massive speculation in the security community when the TrueCrypt.org website started to redirect to this page on SourceForge. The article states the “TrueCrypt” is not secure and you should rather use BitLocker that is built into Windows. Even when trying to install the latest 7.2 version the following message appears.

 

For users that still wish to encrypt their content using TrueCrypt rather install version 7.1a. This can be found in numerous places or can be downloaded here. The biggest challenge is that operating system versions in the near future removes some kind of driver support for the TrueCrypt disk volumes.

Read more about the TrueCrypt sage:

 

 

General
| Tags: