Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I recently was talking with somebody, and they said something along the lines of TrueCrypt having a "master key" password that certain authorities have.

Now, from what I know about how TrueCrypt works, isn't that impossible?

Or is it possible/plausible?

share|improve this question
add comment

1 Answer

up vote 15 down vote accepted

A backdoor could possibly exist, an easy way to achieve this would be to encrypt the passphrase with a public key and store it somewhere with the data portion on the hard disk, so the passphrase could be recovered with the matching private key.

However, TrueCrypt is open source can be peer reviewed:

From the TrueCrypt FAQ

I forgot my password – is there any way ('backdoor') to recover the files from my TrueCrypt volume?

We have not implemented any 'backdoor' in TrueCrypt (and will never implement any even if asked to do so by a government agency), because it would defeat the purpose of the software. TrueCrypt does not allow decryption of data without knowing the correct password or key. We cannot recover your data because we do not know and cannot determine the password you chose or the key you generated using TrueCrypt. The only way to recover your files is to try to "crack" the password or the key, but it could take thousands or millions of years (depending on the length and quality of the password or keyfiles, on the software/hardware performance, algorithms, and other factors). If you find this hard to believe, consider the fact that even the FBI was not able to decrypt a TrueCrypt volume after a year of trying.

And this:

Why is TrueCrypt open-source? What are the advantages?

As the source code for TrueCrypt is publicly available, independent researchers can verify that the source code does not contain any security flaw or secret 'backdoor'. If the source code were not available, reviewers would need to reverse-engineer the executable files. However, analyzing and understanding such reverse-engineered code is so difficult that it is practically impossible to do (especially when the code is as large as the TrueCrypt code).

Remark: A similar problem also affects cryptographic hardware (for example, a self-encrypting storage device). It is very difficult to reverse-engineer it to verify that it does not contain any security flaw or secret 'backdoor'.

I've also found an interesting discussion on TrueCrypt being just a big Honeypot: https://groups.google.com/d/topic/alt.computer.security/LlbvEfGlnwE/discussion

share|improve this answer
1  
Not to mention the fact that Bruce Schneier and a few other well known cryptographers have done a full review of TC from a cryptographic perspective. I can't find the link to it, but I remember reading the results. He probably has something on his blog about it... –  Polynomial Nov 11 '12 at 12:58
    
And the reason TC devs get old versions taken down is because they have may have flaws that have been eliminated. –  ewanm89 Nov 11 '12 at 19:56
2  
Here's the paper: privacy-cd.org/downloads/truecrypt_7.0a-analysis-en.pdf –  Jeremy Stein Nov 13 '12 at 20:22
    
@JeremyStein Thanks, that was a good read. –  Austin Nov 16 '12 at 3:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.