While browsing PasteBin today, I noticed a new Paste that outlined approaches to compromising TrueCrypt protected data, as well as full Keys, Encryption Schemes, Plain-text Files, and Volume Names (and metadata). It was terribly un-nerving.
Appears this Pastebin was copied from this blog post, "TrueCrypt Master Key Extraction And Volume Identification."
My question is, what are the options to mitigate these attack vectors, barring Live-Boot/Read-Only OS's. Or are there any methods?
The Vectors outlined fall into two major categories:
- Keys in Memory - Or keys left in swap-files.
- Cached Data on Disk - Including data in swap-files, file history (some OS's cache files in plain-text), and TrueCrypt metadata (that can identify encryption schemes, volume use history, and identify the volume it's self [a USB drive with certain characteristics, or a specific file]).
Due to OS caching, my initial expectation is that there is no way to mitigate these attack vectors without a Read-Only OS, but I thought this was a good place to double-check.