Truecrypt users here?

[BroncosFan]

Can any truecrypt users type in a decimal point in this screen? I am unable to with win7 64bit Truecrypt V7.1a. I tired the KB, MB and GB option with no luck, just numbers no decimal point allowed on my end, just creating a new simple volume, thanks.
http://www.truecrypt.org/images/docs/tutorial-v6.1-07.png

[bwanshoom]

1492 wrote:

I wasn't referring to Truecrypt 7.2 which is pointless w/no encryption capabilities? :h

Comment was for auditing the fork Veracrypt.

Yeah, I see that now, sorry. My reading comprehension is apparently pathetic today.

Since TrueCrypt has had over 30 million downloads and it's just now getting audited, I highly doubt Veracrypt has been audited.

Odd that Veracrypt is Windows only.

[1492]

It's beginning to look more like the developer's threw in the towel as Brian Krebs indicated. But appears that there is enough support to keep the project alive.

Note that Matthew Green of the Truecrypt audit team warns of arbitrarily downloading Truecrypt from any site, but considers the truecrypt-archive repository link provided above as reliable.

[unbob]

The death of TrueCrypt: a symptom of a greater problem

"At the moment, we have nothing to worry about, as the developers have spoken, and the conspiracies are not true–they are tired, and they are abandoning the project."

The TrueCrypt development team - “I’m taking my ball and going home”

http://bradkovach.com/2014/05/the-death-of-truecrypt-a-symptom-of-a-greater-problem/

[1492]

bwanshoom wrote:

1492 wrote:

BroncosFan wrote:
Veracrypt is a fork of TrueCrypt.

Has an independent audit of its modified code been done? I think the safer approach is to let the original Truecrypt audit to continue, and go on from there?

There's no point in auditing the new version (7.2). It's already been shown to have been gutted: encryption has been removed (it only decrypts), it deletes the help file if found on the system, displays notices about the software being insecure all over the place, etc. I can't imagine anyone installing 7.2 for any reason.

The Open Crypto Audit Project has stated they will complete the audit already in progress of 7.1, though.

I wasn't referring to Truecrypt 7.2 which is pointless w/no encryption capabilities? :h

Comment was for auditing the fork Veracrypt.

[bwanshoom]

1492 wrote:
Has an independent audit of its modified code been done? I think the safer approach is to let the original Truecrypt audit to continue, and go on from there?

There's no point in auditing the new version (7.2). It's already been shown to have been gutted: encryption has been removed (it only decrypts), it deletes the help file if found on the system, displays notices about the software being insecure all over the place, etc. I can't imagine anyone installing 7.2 for any reason.

The Open Crypto Audit Project has stated they will complete the audit already in progress of 7.1, though.

[1492]

BroncosFan wrote:
Veracrypt is a fork of TrueCrypt.

Has an independent audit of its modified code been done? I think the safer approach is to let the original Truecrypt audit to continue, and go on from there?

[Dutch_12078]

1492 wrote:
There is also an independent repository of virtually all versions of Truecrypt at truecrypt-archive.

Truecrypt is just too good an app to just fade away?

Yep, I'll agree with Steve Gibson on that...

[1492]

There is also an independent repository of virtually all versions of Truecrypt at truecrypt-archive.

Truecrypt is just too good an app to just fade away?

[Dutch_12078]

There's a Swiss based effort underway to take over Truecrypt development, likely as a fork as well. At the moment, what they offer are the 7.1a files that are no longer available from the Truecrypt site.

http://truecrypt.ch

Note that the ".ch" top level domain is NOT from China, as some naysayers seem to think, but rather it's the TLD for Switzerland. ".cn" is the TLD for mainland China.

[BroncosFan]

Veracrypt is a fork of TrueCrypt. I read the difference is that Veracrypt has 300 times more iterations of the key-derivation functions. That makes Veracrypt a lot more time consuming to attack by brute-force.

[unbob]

Yes, Virginia, TrueCrypt is still safe to use.

"Those who believe that there is something now and suddenly “wrong” with TrueCrypt because its creators have decided that they no longer have so much to give, are misguided. TrueCrypt's creators may well be right. TrueCrypt may never be as pure and perfect as it is today ? as they created and perfected it. Their final true version 7.1a may be the pinnacle of this story. So anyone would and should be proud to use this beautiful tool."

https://www.grc.com/misc/truecrypt/truecrypt.htm

[unbob]

mlts22 wrote:
For Windows, I use BitLocker because it is available, and very easy to deal with. However, for cross platform compatibility, I may end up moving back to Jetico's BestCrypt (a program I used before TrueCrypt was out for both containers and system encryption.) It isn't open source, but it does have hidden container protection.

Another option I might do is look at Symantec's Encryption Desktop (formerly PGP Desktop.) It works on Mac, Windows, and Linux, and offers the only public key protection on data volumes out there. This is an excellent product, but not cheap, although the source code is downloadable.

Before using either BitLocker or BestCrypt, etc I suggest reading the reader comments on Bruce Schneier's blog - https://www.schneier.com/blog/archives/2014/05/truecrypt_wtf.html

Bottom line: any closed proprietary product is suspect and may in fact have a backdoor to the NSA, FBI, et al. Caveat Emptor.

[bwanshoom]

Regardless of the why the end result is the same - Truecrypt is dead. It can never be trusted again after this incident. Hopefully something will take its place, though.

And although their source was available it was never open source. Just compiling your own version to verify the binaries was exceedingly difficult.

[mlts22]

Lavabit's fate is my worst fear. What TrueCrypt has that no other programs don't is the fact that all the code is out there to be compiled, and unlike other programs, someone has paid $70,000 to audit every single line of the code.