After a long time, almost a year to be precise, the results of the second phase of the audit of the famous program TrueCrypt, used by millions of people to protect their data, have arrived. On one hand, what the first study anticipated is confirmed: TrueCrypt presents itself as a relatively solid program for encrypting disks. However, on the other side we find four new bugs, two of them with a higher risk, that will not have direct fixes...
When the official TrueCrypt website announced in May of last year that its development had ended, we all lost, from users always seeking robust solutions to security experts who spend hours studying lines of code to detect errors. Despite the official radio silence and endless debates, the TrueCrypt audit continued, and yesterday, those responsible for the Open Crypto Audit Project published the results of the second phase. One aspect highlighted in the report is the progress made by the VeraCrypt and CipherShed projects, although it does not mention the fixes they implemented on the base code. This second phase yields a total of four vulnerabilities, and although none of them can lead to a direct loss of confidentiality in normal scenarios, two should be addressed as soon as possible.
The Most Severe Vulnerabilities
The most severe one emphasizes the use of the Windows Crypto API in generating random numbers for the master encryption key. Any condition that could lead to a 'predictable' random number represents a risk, and there are some that prevent the Crypto API from starting correctly. The logical thing would be for TrueCrypt to sound all alarms if that happens, but in version 7.1a (which was used in the audit), it ignores the failure and continues generating keys from other sources. The other vulnerability concerns susceptibility in the AES implementation to cache-timing attacks.
Is TrueCrypt Still Recommended?
Now, the question many have been waiting for (I assume to throw some digital stones at me): Is the use of TrueCrypt recommended? From my point of view, the answer remains no. First, the original TrueCrypt developers never came to light, and that makes us think of two possibilities: Either they know something we don't, or the authorities have pulled their strings enough to keep them quiet. Second, the last build stable of TrueCrypt is more than nine months old, and those who have followed security news during the last half of 2014 know that the world has changed a bit. Third, the audit focused on the cryptographic part of the code, and neither of its two phases has managed to completely rule out the existence of a major flaw. Finally, no one from the original project will continue developing the code, so the only way to see the bugs fixed is through a fork like this Swiss variant of TrueCrypt, or even VeraCrypt. There are also other options, but the final decision, is always up to the user.
