I just had an argument with colleagues about the usefulness of Microsoft BitLocker drive encryption for keeping representatives of the state (FBI etc.) out of data. They were convinced that vendors of proprietary software have backdoors in their algorithms which can be used in severe cases, i.e. suspicion of terrorism etc.
The alternative is of course TrueCrypt, because in theory, the code is open and can be reviewed by the public. In practice, even though I know the programming language, I do not have enough knowledge of the algorithm to be able to spot a possible backdoor or a feature which might give an advantage to a deliberate cryptographic attack. Does anyone know if the code has been reviewed by a trustworthy 3rd party? And if so, how is their trustworthyness established?
So, to come to the general questions:
How would a company which really, really wants to keep their files completely secret decide upon their cryptographic solution? They cannot be 100% sure that BitLocker is safe, can they? However, would they in practice be able to make sure that TrueCrypt is?
How would you estimate the chance that Microsoft and similar companies work with government agencies and give them an advantage to breaking their security so that it doesn't take 1000s of years to break (is that how long BitLocker should take)?