Truecrypt users here?

1492 wrote:

I wasn't referring to Truecrypt 7.2 which is pointless w/no encryption capabilities? :h

Comment was for auditing the fork Veracrypt.

Yeah, I see that now, sorry. My reading comprehension is apparently pathetic today.

Since TrueCrypt has had over 30 million downloads and it's just now getting audited, I highly doubt Veracrypt has been audited.

Odd that Veracrypt is Windows only.

It's beginning to look more like the developer's threw in the towel as Brian Krebs indicated. But appears that there is enough support to keep the project alive.

Note that Matthew Green of the Truecrypt audit team warns of arbitrarily downloading Truecrypt from any site, but considers the truecrypt-archive repository link provided above as reliable.

bwanshoom wrote:

1492 wrote:

BroncosFan wrote:
Veracrypt is a fork of TrueCrypt.

Has an independent audit of its modified code been done? I think the safer approach is to let the original Truecrypt audit to continue, and go on from there?

There's no point in auditing the new version (7.2). It's already been shown to have been gutted: encryption has been removed (it only decrypts), it deletes the help file if found on the system, displays notices about the software being insecure all over the place, etc. I can't imagine anyone installing 7.2 for any reason.

The Open Crypto Audit Project has stated they will complete the audit already in progress of 7.1, though.

I wasn't referring to Truecrypt 7.2 which is pointless w/no encryption capabilities? :h

Comment was for auditing the fork Veracrypt.

1492 wrote:
Has an independent audit of its modified code been done? I think the safer approach is to let the original Truecrypt audit to continue, and go on from there?

There's no point in auditing the new version (7.2). It's already been shown to have been gutted: encryption has been removed (it only decrypts), it deletes the help file if found on the system, displays notices about the software being insecure all over the place, etc. I can't imagine anyone installing 7.2 for any reason.

The Open Crypto Audit Project has stated they will complete the audit already in progress of 7.1, though.

BroncosFan wrote:
Veracrypt is a fork of TrueCrypt.

Has an independent audit of its modified code been done? I think the safer approach is to let the original Truecrypt audit to continue, and go on from there?

1492 wrote:
There is also an independent repository of virtually all versions of Truecrypt at truecrypt-archive.

Truecrypt is just too good an app to just fade away?

Yep, I'll agree with Steve Gibson on that...

There is also an independent repository of virtually all versions of Truecrypt at truecrypt-archive.

Truecrypt is just too good an app to just fade away?

There's a Swiss based effort underway to take over Truecrypt development, likely as a fork as well. At the moment, what they offer are the 7.1a files that are no longer available from the Truecrypt site.

http://truecrypt.ch

Note that the ".ch" top level domain is NOT from China, as some naysayers seem to think, but rather it's the TLD for Switzerland. ".cn" is the TLD for mainland China.

Veracrypt is a fork of TrueCrypt. I read the difference is that Veracrypt has 300 times more iterations of the key-derivation functions. That makes Veracrypt a lot more time consuming to attack by brute-force.