12

I recently was talking with somebody, and they said something along the lines of TrueCrypt having a "master key" password that certain authorities have.

Now, from what I know about how TrueCrypt works, isn't that impossible?

Or is it possible/plausible?

Improve this question

1 Answer 1

Reset to default
16

A backdoor could possibly exist, an easy way to achieve this would be to encrypt the passphrase with a public key and store it somewhere with the data portion on the hard disk, so the passphrase could be recovered with the matching private key.

However, TrueCrypt is open source can be peer reviewed:

From the TrueCrypt FAQ

I forgot my password – is there any way ('backdoor') to recover the files from my TrueCrypt volume?

We have not implemented any 'backdoor' in TrueCrypt (and will never implement any even if asked to do so by a government agency), because it would defeat the purpose of the software. TrueCrypt does not allow decryption of data without knowing the correct password or key. We cannot recover your data because we do not know and cannot determine the password you chose or the key you generated using TrueCrypt. The only way to recover your files is to try to "crack" the password or the key, but it could take thousands or millions of years (depending on the length and quality of the password or keyfiles, on the software/hardware performance, algorithms, and other factors). If you find this hard to believe, consider the fact that even the FBI was not able to decrypt a TrueCrypt volume after a year of trying.

And this:

Why is TrueCrypt open-source? What are the advantages?

As the source code for TrueCrypt is publicly available, independent researchers can verify that the source code does not contain any security flaw or secret 'backdoor'. If the source code were not available, reviewers would need to reverse-engineer the executable files. However, analyzing and understanding such reverse-engineered code is so difficult that it is practically impossible to do (especially when the code is as large as the TrueCrypt code).

Remark: A similar problem also affects cryptographic hardware (for example, a self-encrypting storage device). It is very difficult to reverse-engineer it to verify that it does not contain any security flaw or secret 'backdoor'.

I've also found an interesting discussion on TrueCrypt being just a big Honeypot: https://groups.google.com/d/topic/alt.computer.security/LlbvEfGlnwE/discussion

Improve this answer
6
  • 1
    Not to mention the fact that Bruce Schneier and a few other well known cryptographers have done a full review of TC from a cryptographic perspective. I can't find the link to it, but I remember reading the results. He probably has something on his blog about it...
    – Polynomial
    Nov 11, 2012 at 12:58
  • And the reason TC devs get old versions taken down is because they have may have flaws that have been eliminated.
    – ewanm89
    Nov 11, 2012 at 19:56
  • 2
    Here's the paper: privacy-cd.org/downloads/truecrypt_7.0a-analysis-en.pdf
    – Jeremy Stein
    Nov 13, 2012 at 20:22
  • @ewanm89, no, it's because they want to replace something secure with backdoored closed-source junk.
    – Overmind
    Mar 7, 2017 at 10:57
  • @Overmind Evidence is that it is likely there was no backdoor back in 2012 when that statement was written, this is long before the halt of truecrypt, Snowdon documents and the forking of veracrypt.
    – ewanm89
    Mar 7, 2017 at 11:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .