0

The Gibson Research Corporation (GRC) website is offering the following page with links to download Truecrypt 7.1a.

https://www.grc.com/misc/truecrypt/truecrypt.htm

My question is, can these downloads be trusted? Is there a way to identify if the downloaded programs have been modified from the original 7.1a release?

They offer a link to another site with the hashes of all Truecrypt 7.1a files, but how can we know if we can trust this site too?

I don't think this is the same as asking can you trust driver download websites? because the history behind Truecrypt is rather unique and the original developers of the software removed the links to the 7.1a version and now offer only a download to a cut down version of the software that doesn't encrypt volumes. The GRC website has stepped in to provide downloads to the 7.1a version, which they still argue is still fully functional and secure. This question is to address how can we trust these claims.

2

Even if we assume the files on GRC are untainted, I would still recommend avoiding it because Truecrypt is no longer under development. I would recommend using VeraCrypt instead. For the following reasons:

  • VeraCrypt is an actively developed fork of Truecrypt
  • VeraCrypt can manage volumes created using Truecrypt
  • There was recently an audit performed on VeraCrypt. 26 vulnerabilities were found; 8 of which are critical, which may reflect vulnerabilities in Trucerypt code. The VeraCrypt developers have patched many of the vulnerabilities already.
    More details are available here: https://ostif.org/the-veracrypt-audit-results/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.