1

In a weird announcement on the TrueCrypt page it says that the software is unsafe so we should migrate to BitLocker.

If it is a prank it's sure not funny especially when it comes to data.

Since I want to switch to Linux as my primary OS, I was thinking about Encrypted LVM.

  1. Is this secure just as TrueCrypt full-disk encryption ?
  2. Is it susceptible to cold boot attacks ?
  3. Are there any holes that can allow data recovery ?

Please shed a light on this topic because I bet the TrueCrypt message today raised a lot of panic.

1

Well given that sourceforge recently requested a reset of users' password I would not be too fast to panic. It could still be a joke.

Nevertheless, regarding your questions:

  1. LVM is as secure as any other software - until proven otherwise, i.e. until a vulnerability is found. There's no guarantee of security ever.

  2. Cold boot attacks depend on how long your RAM stores data - regardless of the encryption software you use. One could use a cold boot attack to read your poetry, not necessarily your passwords.

  3. The developers aren't leaving any holes intentionally for data recovery. They are working hard to avoid that - as it would be a serious vulnerability waiting to happen.

UPDATE Somebody pointed out in the comments that the key used to sign the latest "dismissal" release of TrueCrypt appears to be genuine, i.e. the same key used for previous releases. This is likely unrelated to the SF password compromise accident.

  • 2
    Given that the 7.2 release that decommissions the software for future use was signed with the same private key used to sign previous releases, your theory about the project's SF password being compromised does not hold water. – Caleb May 29 '14 at 13:17
  • @Caleb I knew about the key issue, but that does not really prove much. It could be that the key was shared among the developers, and that one of them has gone rogue (or got his laptop stolen, etc). Note that I'm not suggesting either, except for caution before jumping to conclusions. – lorenzog May 29 '14 at 15:12
  • In any of the alternative scenarios you just suggested, the SF security issue would not be to blame. As written your post implies that as a way this could be a joke but you do not cover the actual scenario: if it's a prank hijacking it's much more serious than a SF password db issue as the signing key would be compromised. – Caleb May 29 '14 at 15:20
  • True; the SF password compromise is likely unrelated to the key compromise, but either scenario doesn't exclude the other. My baseline message however is to calm down and wait until the dust settles. Nobody knows exactly what happened for now. – lorenzog May 29 '14 at 15:23
  • @Caleb I updated my answer. Thanks for helping me clarify it. – lorenzog May 29 '14 at 15:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.