5

I like TrueCrypt because its easy to use, the filenames can't be viewed unless you decrypt them.

My questions are:

a) Is there any other encryption software better than TrueCrypt that provides better encryption?

b) Can TrueCrypt be cracked? By bruteforce or whatever methods hackers/crackers use.

3
  • 1
    Hey Ctroy, this looks a lot like a software recommendation request, and doesn't clearly define what makes an answer correct or not. You might take a look over the FAQ and reword your question to make it more objective: "better than TrueCrypt" is a very debatable topic, and the Stack Exchange websites aren't really suited for debate or to be used as forums. (FWIW, TrueCrypt is usually considered to be very good at what it does, and the questions about its strength can usually be answered by its own documentation) Sep 7, 2012 at 14:36
  • A keylogger will hack truecrypt or anything else that requires a password. There are good minipci hardware keylogger for the pre-boot authentication crowd (I am one of them).
    – ixe013
    Sep 7, 2012 at 18:04
  • Yes. Any time soon? Highly unlikely.... also, a keylogger doesn't count, in my opinion. And that isn't called hacking.
    – cutrightjm
    Sep 7, 2012 at 18:04

3 Answers 3

5

In evaluating any encryption software, there's a lot to consider. To really answer the question for yourself you need to look at the source code, or pay someone to do that for you and accept liability for issuing guarantees to you. Only in that way will you know exactly what the software is doing and whether or not it meets your needs and threat model.

The fact that the source code is available in the first place usually says a lot. If you are paranoid, compile it yourself on a trusted system.

I will say that the algorithms TrueCrypt uses to encipher data are industry standard, not crackable without an impractical amount of computation power (unless you select a poor password) and well used and respected by many who are security conscious. It's not insurmountable that someone could find weakness in AES256 or the other algorithms availble to Truecrypt in the future. This is why TrueCrypt offers cascaded algorithms where you can use multiple algorithms at once, at the cost of speed. Also pick a really long and strong passphrase.

You really should read all the TrueCrypt documentation to ensure you are using it properly, as, for example, the full disk encryption is useless if someone walks up to your machine while you are away and you did not lock your computer. This is also true of any encryption or security product.

6
  • I appreciate your help in this regard. I was going through, superuser.com/questions/164162/is-truecrypt-truly-safe?rq=1 and found two interesting points. 1) a claim that TrueCrypt might be provided by the NSA, CIA, or one of those big Federal agencies. b) It has forensic traces in its boot loader. Not sure what the second one means, but would you care to explain?
    – Ctroy
    Sep 7, 2012 at 15:01
  • I'd take the claim that it is government-provided with a large grain of salt. His claim is that "The government encourages the use of encryption software with backdoors. Therefore, TrueCrypt has a backdoor." It might be just me, but I think there's some logic missing. Does the government promote TrueCrypt? No. Most FDE manufacturers do not install backdoors, even at the cost of friction with governments (Microsoft got in a brouhaha with the UK over Microsoft's refusal to put a backdoor in BitLocker). If you're a dyed-in-the-wool conspiracy theorist, though, I imagine that won't convince you.
    – Zac B
    Sep 7, 2012 at 15:14
  • @Ctroy Re: it being government provided, that's be beauty of it being open source. As ultrasawblade mentioned, you can go over the source code yourself and build it on a trusted system to ensure that there are no back doors, even if it is provided by the NSA or CIA or whatever the conspiracy theorists are suggesting. Sep 7, 2012 at 15:22
  • Yeah, but conspiracy/crypto nuts love to point out that binaries distributed by TrueCrypt don't have the same checksums as hand-compiled ones, and therefore, since TrueCrypt doesn't provide their build toolchain, they clearly must be putting a back door in official binaries. Sarcasm, btw.
    – Zac B
    Sep 7, 2012 at 15:28
  • I have no knowledge on checksum or encryption, but isn't that a valid point? Why are the checksums different?
    – Ctroy
    Sep 7, 2012 at 15:29
6

According to http://en.wikipedia.org/wiki/TrueCrypt#Operation_Satyagraha and providing a secure password it it quite safe:

In July 2008, several TrueCrypt-secured hard drives were seized from a Brazilian banker Daniel Dantas, who was suspected of financial crimes. The Brazilian National Institute of Criminology (INC) tried unsuccessfully for five months to obtain access to his files on the TrueCrypt-protected disks. They enlisted the help of the FBI, who used dictionary attacks against Dantas' disks for over 12 months, but were still unable to decrypt them. The case presented a noteworthy real-world test which proved the strength of TrueCrypt.

1

In addition to @ultrasawblade's comments, there are a couple of other things to consider when evaluating TrueCrypt. One of the main alternatives to TrueCrypt (if you're using Windows) is BitLocker. BitLocker can be configured to authenticate against the TPM in your computer, such that a unique key is stored and provided at boot time without you having to know the password. A recovery password is also provided, but it is typically not needed and can be stored in a secure location.

This brings me to the biggest (IMO) weakness with TrueCrypt: it requires users to memorize and repeatedly enter another password. This leaves users' hard drive encryption vulnerable to the most common attack in the world: password compromise. Either by sharing it with others ("Hey, Bob, I'm not there right now, but just get those files off of my computer. Yeah, you can log in with your username and password, but first you have to enter this one at the black screen with the white text--that password is 'password'") or by writing it down on a post-it somewhere easily readable.

The cryptography algorithms used by both TrueCrypt and BitLocker are fairly strong, and would require a lot of resources, both physical (access to the hard drive) and computational to crack, but I prefer BitLocker because it is built according to the philosophy of "your Windows login should be the only security you need, and your hard drive should transparently boot windows if it is in its original computer."

To be sure, there are restrictions in using BitLocker: you have to be running Windows 7 Ultimate or similar and have a TPM-capable computer. It's not without vulnerabilities, either: the recovery passphrase can be stolen (though it doesn't have to be used all the time, so the risk is lower), the TPM can be cracked (unlikely), or the user's Windows login could be compromised.

For more information on full disk encryption software, check out this wiki article.

Not the answer you're looking for? Browse other questions tagged .