TrueCrypt 4.3 Released

RedBear writes "A new update to the best open source transparent encryption software has been released. TrueCrypt is (the only?) open source encryption software capable of creating and mounting encrypted virtual disk images that can then be worked with transparently like any other storage drive, with data encrypted and decrypted in real-time. These virtual disks can be created as files, or entire partitions or physical drives can be encrypted and mounted transparently. Sadly there is still no Linux GUI or Mac OS X port in sight. If you are one of the thronging hordes who have been patiently awaiting ubiquitous multi-platform encryption, please consider donating time or money to the cause, and add your voice to the forum." From the site:"Among the new features [are] full compatibility with 32-bit and 64-bit Windows Vista, support for devices and file systems that use a sector size other than 512 bytes (such as new hard drives, USB flash drives, DVD-RAM, MP3 players, etc.), auto-dismount when a host device (e.g., a USB flash drive) is inadvertently removed, and many more." Read on for more features of TrueCrypt and cached versions of all the links above.

Also including features like plausible deniability, steganographically hidden volumes, unidentifiable partition headers, traveler mode, and your choice of the strongest available encryption algorithms up to and including multi-algorithm cascades. TrueCrypt is practically the Holy Grail for advocates of free ubiquitous encryption. Now, if only it were platform independent.

To reduce load on their servers here are some Coralized versions of all the links:

TrueCrypt home page
Future development goals
Forum thread about Mac OS X version
Donations page
General forum
Plausible deniability
Hidden volumes
Traveler mode
Encryption algorithms
Multi-algorithm cascades
Version history

The coolest part.

[Lumpy]

you dont have to install it. so there is no way that any researcher can discover it was used.

I can not believe that the other encryption software out there is not even 1/20 as good as truecrypt.

you can hide your data pretty easy with it.

Re:The coolest part.

[Eddi3]

"you dont have to install it. so there is no way that any researcher can discover it was used."

That's not entirely true. When TrueCrypt opens, it installs a driver (in Windows). This driver remains there unless you remove it. In fact, I just had to manually remove it because the old version of the driver was already installed, and the new version of it couldn't override it.

Don't get me wrong, I absolutely LOVE TrueCrypt, I use it everyday, however it's not entirely true that it leaves no footprint. At least, not in my experience.

  -Eddie

Pet Peeve

[bogie]

Driver versions being incompatible and not overwritable. For example the thumb drive I carry around uses True Crypt but now next time I plug it into my desktop I'll get the incompatible driver error.

Re:

[computer_guy57]

Also, IIRC when you use it on Windows, even in traveler mode, it might make registry entries that might linger around. It is possible that soneone dedicated enough could find out that you've been using it.

One other downside worth mentioning is that on Windows you have to have administrator rights on the machine to use it.

Re:

[pyite]

HKEY_CURRENT_USER

Re:

[xtracto]

And in Linux it is NOT possible to use it in any computer unless you have ROOT access (to install it). I have a 2GB USB stick and I wanted to use half of it as an encrypted drive. In Windows environments I could use it without problems but there is *no* way to access the drive in Linux unless you have root access to mount the device, or unless the computer you are using has got FUSE *AND* you are allowed to mount this file system (sheesh in FC6 I am not allowed to mount a simple USB device unless I've got r

Re:

[Anonymous Coward]

there is no way that any researcher can discover it was used.

wrong, if you read the info on the site about "traveller mode"

After examining the registry file, it may be possible to tell that TrueCrypt was run (and that a TrueCrypt volume was mounted) on a Windows system even if it is run in traveller mode.

so it still writes to the registry and so can be discovered by forensics in an instant
why it writes to the registry really needs to be addressed, i wish apps went back to the old .ini method of storing conf

Re:The coolest part.

[Eddi3]

Generally, Windows itself keeps the names of files that have run recently, and that's probably what they're refering to, not TrueCrypt's settings. In that aspect, no executable on Windows can leave absolutely NO footprint. Of course, these registry entries can be removed manually.

In fact, TrueCrypt's settings are maintained in a file called Configuration.xml in the same directory as TrueCrypt.exe, in order to remain truly portable.

Re:

[SirTalon42]

Don't forget that to load drivers you have to modify files on the system (unless you use an ugly hack, but then the driver may be swapped out which can be Very Bad (TM) in some situations (especially if the key is swapped out!).

Re:

[Lumpy]

windows writes last ran items to the registry. Simply renaming the executable to notepad.exe will solve that problem. If truecrypt writes anything to the registry then it does have a major flaw, I need to look further into that.

Re:The coolest part.

[Anonymous Coward]

from the truecrypt site:

Traveller Mode

TrueCrypt can run in so-called 'traveller' mode, which means that it does not have to be installed on the operating system under which it is run. However, there are two things to keep in mind:

        * You need administrator privileges in order to able to run TrueCrypt in 'traveller' mode.
        * After examining the registry file, it may be possible to tell that TrueCrypt was run (and that a TrueCrypt volume was mounted) on a Windows system even if it is run in traveller mode.

If you need to solve these problems, we recommend using BartPE for this purpose. For further information on BartPE, see the question "Is it possible to use TrueCrypt without leaving any 'traces' on Windows?" in the section Frequently Asked Questions.

Re:

[Anonymous Coward]

Rename truecrypt on your thumbdrive to vi. now all it shows is that you ran VI from /mnt/sda1/utilities

Now if you can get that I ran the trucrypt binary that was renamed to vi on that thumbdrive then you are an incredible researcher and need to be working for the FBI/NSA right now.

leave the history intact. it shows I ran VI.

Re:

[stuuf]

But if you have to run it from the command line, you probably need to give it command-line arguments. Do truecrypt's typical arguments look like typical vi arguments?

$ unset HISTFILE

Re:

[CastrTroy]

Easy, Just ensure that you're home partition is encrypted.

Re:

[Anonymous Coward]

look at the first few bytes of the file and determine that it's a TrueCrypt volume.

The first few bytes of the file contain the encrypted symmetric key for the block cypher, which looks random, just like the rest of the file.

it will even tell you what volume you've mounted - Standard or Hidden

So? By definition that information has to be available or Truecrypt wouldn't know where to read or write. That it's displayed to you doesn't make a difference if someone gets to inspect the running system. Plausible den

No OS X Port?

[CheeseburgerBrown]

What are the advantages of this software over using an encrypted disk image created with Tiger's build-in Disk Utility?

Re:No OS X Port?

[Mr2001]

Hidden volumes, for one. A single image can have two volumes in it, with different passwords, encryption methods, etc., and you can't even tell the hidden one is there unless you know the key.

You can also use any file as the key, instead of (or in combination with) a password.

And you can encrypt an entire partition, instead of putting the image inside another filesystem and letting it get copied around by the defragmenter (which may have security implications for the ultra-paranoid).

Re:

[networkBoy]

And therein lies its true power.
As an example:
I have a volume with porn in it. The hidden volume contains other things. All I can divulge is that first password and they get a volume of porn. Hey, I was hiding my secrete homo-autoerotic transvestite fetish from my S.O. Nevermind the 15 megs of "unused" space at the end of the volume.
-nB

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:No OS X Port?

[Mr2001]

Nope.

When you create the (main) volume, it's filled with random data. Formatting overwrites some of that, but the empty space is still full of random bytes. So, let's say you create a main volume on a 100 MB partition, and copy over some "cover" files, leaving 75 MB of free space at the end.

Then you create a 50 MB hidden volume, which is stored at the end of the partition. You put your top secret files in there, dismount it, and remount the main volume. The main volume still says "100 MB total, 75 MB free", and the free space still appears to be full of random bytes (since the hidden volume is encrypted), but they're different random bytes than they were at first.

So no, you can't tell just by looking at the mounted main volume that there's a hidden volume. All you can do is suspect that there might be something hidden in that free space, but you can't prove it - there are no plaintext headers, so both volumes are completely encrypted and appear random without the correct key. TrueCrypt will even let you reformat the main volume, destroying the hidden volume in the process, unless you specifically tell it to protect the hidden volume (using the correct key) when you mount the main one.

OTOH, you might be able to make a snapshot of the entire encrypted partition (without alerting the owner), then come back later and look for changes once you've gotten him to give up the key to the main volume. If the changes are in the main volume's free space, and they can't be explained by creating and deleting files, then you know there's a hidden volume. However, this requires covert monitoring over a period of time while the system is in active use; you can't detect the hidden volume simply by seizing a drive and examining it all at once.

Re:

[bendodge]

you can't detect the hidden volume simply by seizing a drive and examining it all at once.

I might just be naive (as I have never used TrueCrypt), but I don't understand why you can't just look for the true TrueCrypt driver, run the appropriate TrueCrypt version and brute-force the user password until you get to see everything.

Re:

[mOdQuArK!]

Go look up how long it would take to "brute force" a good key with a good (as in, hasn't been mathematically broken yet) encryption implementation. It's not something you should worry about.

Of course, if someone can access your computer as freely as you've described, it would probably be a lot easier for them to install a keylogger program (or a hardware hack) & get your secret key when you type it in.

Re:

[bendodge]

They only have to force the user password, not the actual monster key.

Re:

[mOdQuArK!]

I was talking about the user's password when I mentioned a "good" key.

Here's a page from Microsoft that does some calculations on how hard it is to brute force a good key:

http://www.microsoft.com/technet/security/secnews/ articles/itproviewpoint091004.mspx [microsoft.com]

and the followup article about using passphrases:

http://www.microsoft.com/technet/security/secnews/ articles/itproviewpoint100504.mspx [microsoft.com]

Not lifetime-of-the-universe lengths of time, but any security-conscious individual can certainly make their hidden passwo

Re:

[Anonymous Coward]

I might just be naive (as I have never used TrueCrypt), but I don't understand why you can't just look for the true TrueCrypt driver, run the appropriate TrueCrypt version and brute-force the user password until you get to see everything.

Brute forcing true crypt takes a LONG TIME. Just using the standard truecrypt executable, it takes about 2.26 seconds per guess on my Athlon 2500+. To put that in perspective, it would take my machine nearly 70 days to brute force a 4 charactor password (Aprox 14 million

Re:No OS X Port?

[Mr2001]

If your encrypted data doesn't look random, you need to replace your encryption program ASAP. Any patterns in the output are failures in the algorithm.

Re:

[Mr2001]

No.. in fact, that would just make it more obvious that you've got a hidden partition. Here's how the covert monitoring might work:

Monday morning, the attacker sneaks in and records a snapshot of your 100 MB partition.

Friday evening, he comes back with guns blazing and forces you to reveal a key. He uses it to mount both copies of your main volume, the current one and the snapshot, and then compares them byte-for-byte. Some of the changes are in files present on the main volume, but other changes are in fre

Re:No OS X Port?

[Simon Garlick]

Why don't you download the source code for Truecrypt, and the source code for OS X Disk Utility, and compare how they implement their respective algorithms. The advantage will be pretty obvious.

Re:No OS X Port?

[Sancho]

Ah ha! Therein lies the obvious advantage!

Re:No OS X Port?

[Simon Garlick]

That, believe it or not, is my point. We have no way of knowing how secure OS X Disk Utility is. For all we know every encrypted .dmg can be decrypted with one master passphrase. For all we know the algorithms are deliberately crippled. We'll never know, because we can't audit the source.

Re:No OS X Port?

[Solra Bizna]

Blew mod points to respond to this.

Disk Utility, the graphical application, is not open source. diskutil and hdiutil, the command-line programs it is a front-end for, are open source. I don't know whether the DiskImages framework (which hdiutil could be considered a front-end for) is open source, though. (my guess is "yes")

-:sigma.SB

Re:No OS X Port?

[fbjon]

It has some advantages: it's portable, and it has plausible deniability (hidden partitions).

Re:

[Mr2001]

TrueCrypt provides device-level encryption, so it doesn't need to be aware of HFS+ or any other filesystem you use with an encrypted volume. It also provides a few important features that are not built into OS X.

Re:

[Mr2001]

I did list them earlier [slashdot.org], and they're listed on TrueCrypt's site as well as all over the rest of this thread. The main feature is hidden volumes.

Linux downloads available

[tabo_peru]

"from the windows-only-alas dept."

Not really, you can download ubuntu binaries from their download section [truecrypt.org].

Re:Linux downloads available

[GenKreton]

Except, the summary implies it is the only opensource method of doing this when, in fact, linux has several others and a few of them are superior (like a few luks implementations using dm-crypt).

Re:Linux downloads available

[ink]

Yep, I've been using luks under Linux for ages. It works transparently, and is portable from system to system. I don't think that the article submitter has ever used OSX or Linux; both have nice, mature encrypted block systems.

Hell, I used PGPdisk back in the '90s, and it was "all that".

Re:

[Bishop]

plausible deniability, hidden volumes and all that other good stuff talked about on the TrueCrypt site.

That is because real security experts know that plausible deniability and hidden volumes are script kiddie features that don't work in the real work. Both "features" assume unrealistic attackers. In the real world there is little point in pretending that an encrypted volume isn't. The attacker is going to assume that it is regardless of what you claim.

Re:

[drinkypoo]

When a court of law sees random data they are going to assume cryptography. It is going to be tough to convince a court differently. Hidden volumes may give an out, but counting on that is foolish.

The point is that your actual volume is hidden within a decoy volume. You give them the key to open the decoy volume, and they find a bunch of files that won't get you incarcerated.

Assuming that an attacker is going to be able to find all the encrypted data and planning for it is a saner course of action.

There

Re:

[ndansmith]

The Linux version of Truecrypt (mostly) works on PowerPC as well. I currently use it with Gentoo on my iBook. What is broken is creating volumes. Truecrypt on ppc seems to have trouble creating the file system on the encrypted volume properly. However, volumes created on x86 (Windows or Linux) can be opened and modified on ppc. It's plenty cross-platform for me.

Raarrgh

[psaunders]

If you are one of the thronging hordes who have been patiently awaiting ubiquitous multi-platform encryption

Yes, I am one of the thronging hordes! *stomp stomp stomp*

Re:Raarrgh

[gardyloo]

Shit. And here I originally read it as "thonging hores" and I was all excited that, finally, here was a post worth reading.

    So much for education.

debian has transparent encryption

[Danny Rathjens]

Why do you need a linux GUI for something like this? I installed debian etch a while ago and noticed encrypted partition was a an option along with normal filesystems, RAID, and LVM. So I tried it out. It was quite simple to setup. I made an encrypted / and an encrypted swap partition. Then when I booted into freshly installed system I had to enter my passphrase for each partition and after that it was just like a normal system. I didn't even notice any I/O performance loss. (Although I still went back to a RAID system after the experiment since I am not paranoid enough to sacrifice any performance or space yet :)

Re:

[CastrTroy]

The same option is available in the Mandriva install. Although you have to select the advanced option for it to show up. Encrypt your swap partition, along with your home partition, and you probably don't have to worry much about leaking your personal data. There's other stuff in the /tmp and /var folders that you may want to worry about, but not too much that I would worry about.

Re:

[Rich0]

While I agree that transparent encryption is a built-in kernel feature in linux (and has been for some time), one thing truecrypt does offer is plausible deniability with hidden partitions. This allows you to store data in a volume whose existence is impossible to infer (unless you somehow record its existence elsewhere - like in a shell history). You can enter one password and get one set of data, and another password to get a different set of data. If you're threatened and asked to divulge the decrypti

Re:

[Kjella]

Although I still went back to a RAID system after the experiment since I am not paranoid enough to sacrifice any performance or space yet :)

Not entirely sure what you're hinting at here with the space bit, the encryption is 1:1 and doesn't consume any space (except maybe a few kb headers), and you can use whatever combination of crypto/RAID/LVM you want, looped into each other. Also if you want an encrypted container you can create that on a current system, the only reason you need the installer is if you'r

Nothing to see here

[Kpt Kill]

Only pirates, terrorists, and criminals need encryption. :)

Re:

[networkBoy]

Or those of us who would like to store personal documents on our work PCs (allowed by AUP), but would rather not have a snoopy admin remote in and see them, or when the notebook is in for service have the service people snoop around. All they see is a single large file called video.corrupt.save.

While ideally they wouldn't snoop for snooping's sake, we all know there are wanna-be Simons out there :-(

-nB

Re:Nothing to see here

[wile_e_wonka]

I keep the family meatloaf recipe on a TruCrypt partition. No one has discovered it yet!

Anyway--I think there are legitimate reasons to want to encrypt data. How about a doctor wanting to ensure patient records are private? Or a corporation that has done some research that it doesn't want to get out? Or what about your personal diary (some people, believe it or not, don't think MySpace is the best place for a private diary)? Or what if you work for the CIA and have been stealing data from a small quiet--a little too quiet--Scandinavian company for a couple years...and they find you out and take your computer after breaking your legs? (ok, that last one's a stretch).

I'm sure commenters will add many more legitimate items to this list.

Re:

[dtzWill]

Only pirates, terrorists, and criminals need encryption. :)

...which according to the media industry and the US government is just about everyone. :-D

Brute force attack built in, is what I want

[apathy maybe]

(Along with anarchy and freedom. But I think the subject is more likely just now.)

I had the recent misfortune to forget the password to an encrypted file. It has stuff that isn't that important or/and can be replaced, but the point is, it takes time to replace this sort of stuff (if it can be replaced). The reason is simply, running on a laptop, if it falls into someone elses hands (and they manage to get past the various passwords (reset the BIOS, insert KNOPPIX away you go)) I don't really want them to

Re:

[SirTalon42]

Or, just remember your password. It really isn't that hard to do!

You could always use something like jack the ripper to try and brute force your password. You'd still have to produce your own dictionary file though.

Re:

[vhold]

Hmm, it's an interesting story. If you are encrypting things that are vitally important to you, but you don't really care about the privacy enough that you are willing to keep unencrypted backups or write passwords down, perhaps you should just use weak encryption that can be reasonably broken, or simply weak passwords.

Re:

[Sancho]

The best solution is an unencrypted version with strong physical security (i.e. a safe, or the equivalent). You use the encrypted version most of the time because, simply, it is easier to work with. If you lose the password, open the safe to recover it.

Algorithm Cascades == BAD?

[Anonymous Coward]

I am, actually, a mathematician (though not a cryptographer), but I could've sworn that doing "cascades" like this is actually a bad idea, mathematically? I seem to remember times where it can actually *weaken* the overall level of protection if you just do it carelessly without regard to the mathematics.

Other than that, it is a very nice little program.

Re:Algorithm Cascades == BAD?

[Copid]

I am, actually, a mathematician (though not a cryptographer), but I could've sworn that doing "cascades" like this is actually a bad idea, mathematically? I seem to remember times where it can actually *weaken* the overall level of protection if you just do it carelessly without regard to the mathematics.

My understanding is that in the general case, there's no truly compelling reason to believe that cascades are either stronger or weaker. I believe that there are special cases with certain algorithms, but the people who maintain TrueCrypt are aware of them. I don't recall the exact details, but it's discussed fairly frequently on sci.crypt.

Re:

[Anonymous Coward]

If multi-algorithm cascades weakened the protection, that's what the codebreakers would do: encrypt the data again and crack the "weakened" data.

Re:

[Copid]

If multi-algorithm cascades weakened the protection, that's what the codebreakers would do: encrypt the data again and crack the "weakened" data.

There's a special case you're not considering: Multi-algorithm cascade with the same key. Arbitrary (and dumb) example: A single cipher in CTR mode. Encrypt once with key k and you're in good shape. Run the algorithm again with key k and your data is plaintext again. It's an extreme case, but one can come up with other more reasonable thought experiments.

FreeOTFE?

[Lawrence_Bird]

I have been using this and have no association other than as a happy user. From the description I don't
think TrueCrypt is "the only" one.

Clipped (and truncated) from the website: [freeotfe.org]

FreeOTFE: A free "on-the-fly" transparent disk encryption program for MS Windows 2000/XP/Vista PCs and Windows Mobile 2003/2005 PDAs Using this software, you can create one or more "virtual disks" on your computer - anything written to these disks is automatically, and securely, encrypted before being stored on your computers hard drive.

Features

        * Source code freely available
        * "Portable mode" included; FreeOTFE doesn't need to be installed before it can be used - making it ideal for carrying your data securely on USB drives!
        * Operates under both PC (MS Windows 2000/XP) and PDA (Windows Mobile 2003/2005) platforms
        * Linux compatibility (Cryptoloop "losetup", dm-crypt and LUKS supported)
        * "Hidden" volumes may be concealed within other FreeOTFE volumes, providing "plausible deniability"
        * FreeOTFE volumes have no "signature" to allow them to be identified as such
        * Encrypted volumes can be either file or partition based.

Re:

[geminidomino]

Does that one work without Admin privs? That's what kills TC's use for me.

Re:

[geminidomino]

It is true for TC as well. Blast it.

Re:

[user24]

I just use commandline gpg. sure, anyone can tell there are encrypted files on my USB 'disk', but so what? I'm not a secret agent, nor a corporate informant, I don't actually need plausible deniability.

It doesn't need admin privs, leaves no tracesif set up properly, and is open source. If you want to store multiple files under one encrypted file, slap them in a zip file and encrypt that.
Don't get me wrong, I'm sure there are legitimate purposes for transparent volume encryption, and plausible deniability, b

TrueCrypt also supports 'plausible deniabilty'

[schweini]

I just wanted to point out that TrueCrypt differs from most other disk-encryption-tools mentioned by my fellow posters in that it also supports 'hidden volumes', which allows a user (for example if forced to give out a password, since the existence of an encrypted volume seems suspicious) to give out a password, which simply shows a 'bogus' partition - but there is no way to prove that the password that was provided is not the 'important' one, or for that matter it's impossible to prove that such a hidden volume even exists.

Dangerous feature

[cortana]

Your interrogators will just keep pushing you, and you can give them as many passwords as you want, even as many as you can remember or as exist, and they will keep on torturing you until you die.

Re:

[cptgrudge]

If you're going to be indefinitely held while being tortured, until you die or are killed, all the software features in the world aren't going to help you. It's more useful in places where "plausible deniability" can be used to get you out of trouble, not in countries or organizations where the concept is irrelevant.

Good interim solution . . .

[scarolan]

Truecrypt is a great solution for people who work on laptops and need to cart around sensitive data. On Windows, you can actually encrypt your entire "My Documents" folder. Unfortunately it's quite a bit harder to encrypt the entire user data directory (C:\Documents and Settings\username\), at least I haven't found an easy way to do it yet. Maybe some other Slashdotter has figured this out?

Hopefully hardware-based encryption will become standard soon. I want to boot up, type in my passphrase, and have A

Spread the word - truecrypt volumes can be rsync'd

[enselsharon]

Or is the word rsunc ? Regardless, a lot of people do not realize that a truecrypt volume, although it is a single encrypted file, can be successfully kept up to date with the rsync tool. This is because the entire file is NOT reorganized every time it is unmounted. Therefore, if you only change a few files in a truecrypt volume, you can rsync it to a remote system in an efficient (changes only) manner.

Just be sure to read about the --checksum option. I personally keep all of my most sensitive files in

Re:Spread the word - truecrypt volumes can be rsyn

[Copid]

Or is the word rsunc ? Regardless, a lot of people do not realize that a truecrypt volume, although it is a single encrypted file, can be successfully kept up to date with the rsync tool. This is because the entire file is NOT reorganized every time it is unmounted. Therefore, if you only change a few files in a truecrypt volume, you can rsync it to a remote system in an efficient (changes only) manner.

It should be noted that this is not necessarily a good idea if you have a hidden volume and like to writ

EncFS

[jumperboy]

I use EncFS http://arg0.net/encfs [arg0.net] on Linux every day and love it. Even root can't snoop a mounted directory (but could delete the encrypted source directory). How is TrueCrypt better?

Re:

[Creepy Crawler]

Might I remind you that root CAN read /proc/kcore .

Do you have a system in that which memory is encrypted to prevent superuser attacks (TPM)?

Fedora Blues

[mwilliamson]

...and just like the previous versions of Truecrypt, all indications are its once again gonna be a little bitch trying to get it to build on FC6.

Virtual Machine + TS = Fully encrypted OS?

[ancientt]

I use truecrypt because I need to be able to hand over my laptop to a gun wielding thug if it ever comes up. This got me to thinking, if its a virtual filesystem, and seen as such by Linux, what would happen if I put my entire virtual machine on an encrypted partition. Would it then be possible for me to use Linux with TS + Xen (or VMWare if you prefer) to provide an entirely encrypted OS, including its filesystem? I'd assume that I'd need to have no swap (or file based swap, also on an encrypted partition) but that seems pretty doable to me. If my machine gets stolen, then is everything on the encrypted partition as safe as my password?

Sure

[Sycraft-fu]

So long as the VM's disk is on an encrypted volume, that'll work. As you noted, swap is a potential problem. If your VM can mark it's memory as non pageable, that'd probably do the trick.

eCryptfs

[omnirealm]

If you don't necessarily need plausible deniability, and if you're looking for per-file encryption with just as much transparency and a lot more flexibility, check out eCryptfs. It can be used directly on top of your existing mounted filesystem in Linux. eCryptfs has been in the mainline Linux kernel since 2.6.19. Here is a section in the eCryptfs FAQ that compares and contrasts block device encryption with stacked filesystem encryption:

http://ecryptfs.sourceforge.net/ecryptfs-faq.html# compare [sourceforge.net]

Caveated Gush

[BillGatesLoveChild]

Now this is nice! Even since PGP took away PGPDisk from the freeware version and Scramdisk went commercial, we've been screwed for open options. I've been using Filedisk: http://www.acc.umu.se/~bosse/ [acc.umu.se] It's Windows and Linux, reliable (used for years with no data losses) and the source is there. But it's very bare bones and a CLI only.

TrueCrypt looks good. It's got a nice GUI, explains everything, has promised not to go commercial and best-yet they give you the option to use MULTIPLE CIPHERS! YAY! As in why

Caveated Caveat

[BillGatesLoveChild]

Not as bad as I thought: It only goes online for help during volume creation. Once you start TrueCrypt proper there's a PDF.

Whole Disk Encryption missing from TrueCrypt

[SpecialAgentXXX]

The biggest drawback, and a showstopper for me, is the lack of Whole Disk Encryption. Sure, you can boot Windows XP in a 5GB partition and encryption all of your other partitions using TrueCrypt, however the Windows paging file, Documents & Settings (and all of the hidden files in there), etc. are left unencrypted. I use PGP Whole Disk Encryption for Windows XP and it works wonderfully on my laptop.

I would use TrueCrypt in conjuction with PGP WDE, however, on a secondary harddrive containing, um, "a

Will it run on OS X command line?

[Beryllium Sphere(tm)]

OpenBSD runs Linux binaries under emulation, does OS X? Could it be made available through fink?

Laptop data-security using TrueCrypt

[rao]

I've written a TrueCrypt-based simple HOWTO for laptop data-security.

Its called "Steal my laptop (I don't care) - Securing laptop-data"

Here's the link to it:
http://ergo.rydlr.net/?p=39 [rydlr.net]

Bootable FDE?

[DigitAl56K]

Can you do full disk encryption on the primary partition - i.e. does it have it's own bootloader yet? This would make it a nice replacement for DriveCrypt Plus Pack...

Re:

[Mr2001]

Exactly as described? Does Disk Utility let you create hidden volumes (indistinguishable from the main encrypted volume unless you know the key), or encrypt an entire partition, or use a file instead of a password as the key?

Re:

[Whiney Mac Fanboy]

allows you to create encrypted disk images that operate exactly as described.

I don't expect you to read the article, but at least read the summary. Does disk utility give you plausible deniability, steganographically hidden volumes, unidentifiable partition headers, traveler mode, and your choice of the strongest available encryption algorithms up to and including multi-algorithm cascades?

I'm afraid this is definitely an area where os x lags.

Re:

[Reaperducer]

Does disk utility give you plausible deniability, steganographically hidden volumes, unidentifiable partition headers, traveler mode, and your choice of the strongest available encryption algorithms up to and including multi-algorithm cascades?

I'm afraid this is definitely an area where os x lags.

Maybe because the tinfoil hat crowd usually doesn't buy Apple computers.

While I support a lot of what the FOSS movement does, I think this is a good example of the overall trend -- it (over)fills very small nich

Re:

[Whiney Mac Fanboy]

Maybe because the tinfoil hat crowd usually doesn't buy Apple computers.

Errrr right - did you not read the linked thread where all the os x users were asking for a truecrypt port?

While I support a lot of what the F/OSS movement does, I think this is a good example of the overall trend -- it (over)fills very small niches very well, but doesn't do much for the masses.

Right dude, apart from the craploads of FOSS stuff you use on your mac every day? OS X is built on F/OSS - absolutely nothing on the system woul

Re:

[Mr2001]

Maybe because the tinfoil hat crowd usually doesn't buy Apple computers.

This stuff isn't just for the tinfoil hat crowd.

If you're using encryption at all, it's because you want to keep something private, right? Now imagine someone discovers an encrypted partition on your computer. In some circumstances (e.g. if you live in the UK), you may be forced to reveal the password, or punished for refusing to reveal it. So you can either accept the punishment, or reveal the files that you thought were private enough to justify using encryption in the first place.

That's not a good outco

Re:

[Anonymous Coward]

They're too busy moving their pr0n collections to new TrueCrypt disks.

Re:

[SirTalon42]

Loop-aes was deprecated because there were problems with the implementation IIRC (use dm-crypt instead!). Also if you put it in the fstab, that means EVERY SINGLE TIME YOU BOOT you have to be at a keyboard to enter in all the passwords before the system will finish booting (and then you only have protection while your machine is off!)

A GUI to mount/umount a volume would be useful to just setup a little utility with a link say on your desktop so all you'd have to do is click the icon on your desktop/panel/m

Re:

[cortana]

I'm sure someone here could whip that up in Perl/Tk for loop-aes in an hour or two. I'm no programmer, so I won't bother...

Nooo, that would not be very safe. If you are typing your passphrase into an X11 session then there is nothing to stop another X client from stealing it. ;)

Re:

[Anonymous Coward]

We all do. We thought you knew about it?

Re:What a load of BS...

[Binestar]

If you have a container X big, one can have smaller containers inside that. The key opens the outer container, but exposes the inside (to use their language). Even if these hidden volumes dont have publically readable containers, one can still see them and delete them.

Incorrect, there is no container file inside the first container, and if you don't enter the password for the second container the same time as the first container you *CAN* overwrite the data in the second container, thus corrupting it.

From the website (If only people would RTFM (no, I'm not new here)):

Protection of Hidden Volumes Against Damage
As of TrueCrypt 4.0, it is possible to write data to an outer volume without risking that a hidden volume within it will get damaged (overwritten).

When mounting an outer volume, the user can enter two passwords: One for the outer volume, and the other for a hidden volume within it, which he wants to protect. In this mode, TrueCrypt does not actually mount the hidden volume. It only decrypts its header and retrieves information about the size of the hidden volume (from the decrypted header). Then, the outer volume is mounted and any attempt to save data to the area of the hidden volume will be rejected (until the outer volume is dismounted).

Note that TrueCrypt never modifies the filesystem (e.g., information about allocated clusters, amount of free space, etc.) within the outer volume in any way. As soon as the volume is dismounted, the protection is lost. When the volume is mounted again, it is not possible to determine whether the volume has used hidden volume protection or not. The hidden volume protection can be activated only by users who supply the correct password (and/or keyfiles) for the hidden volume (each time they mount the outer volume).

Re:

[Creepy Crawler]

Oh well. Ive already taken a mod hit (I dont care). Ill respond to your refutation.

---Incorrect, there is no container file inside the first container, and if you don't enter the password for the second container the same time as the first container you *CAN* overwrite the data in the second container, thus corrupting it.

I am talking about this link [truecrypt.org] in which displays a large container and 2 containers inside of it. The text accompanying it is also sort of misleading. What does worry me is this statement:

"NT

Re:

[Copid]

How I would attack this stego: I would obtain a sector-logger via ICE or somesuch driver first. Then I would mount the container and proceed to do a "DOD 7 times rewrite" via eraser or somesuch tool. I then would watch what sectors arent affected. Those would be the hidden ones. Essentially I would show hidden places by what isnt touched.

More terse version of another response you've seen already: If you do this, TrueCrypt will happily overwrite the hidden sectors and you will get nothing. TrueCrypt will

Re:

[enos]

The hidden volume is put in the empty space of the outer volume. You can't tell it's there because all volumes are filled with random bits upon creation. Since a good encryption algorithm's cyphertext looks random, you can't tell if it's still the random data from the format or a hidden volume. You need the hidden volume's key so you can decrypt it and only then will you know that it even exists. When you mount a volume and it asks for a password, it first tries it with the outer volume, and if that fails i

Re:

[Creepy Crawler]

---The hidden volume is put in the empty space of the outer volume. You can't tell it's there because all volumes are filled with random bits upon creation.

I understand that. I'm not going to challenge if the random # gen is actually random, because that is aside the point.

Instead, if one can watch the sectors and bits changed, one can identify after the "sucker" password is given. A hidden volume can be identified. Also, one would have to be absolutely sure that any parts of the unencrypted system does not

Re:

[Copid]

Instead, if one can watch the sectors and bits changed, one can identify after the "sucker" password is given. A hidden volume can be identified.

I think you're really not understanding how this system works. If you only have the "sucker" password, you can manipulate the contents of the mounted outer volume all you want. TrueCrypt, having no clue that there's a hidden volume, will simply overwrite useful data blocks and destroy the hidden volume. Hidden volumes are only protected from corruption if you

Re:This really is not _the only_ program out there

[drmerope]

Yes. Seriously. You've been able to do this in FreeBSD for ages.

dd if=/dev/zero of=image_name bs=1k count=lenth
mdconfig -a -t vnode -f image_name -u 0
geli init -a hmac/sha256 /dev/md0
geli attach /dev/md0
dd if=/dev/random of=/dev/md0.eli bs=1m
newfs /dev/md0.eli
mount /dev/md0.eli /mnt/secret

okay its a bunch of commands, but I'm basically reading out of the man page. And this setup has tamper detection.

Re:

[minion]

I run a server with a RAID-1 setup. After a few months a disk fails. I remove it and want to get it replaced under warranty. The problem is that the disk isn't in a good enough condition to be able to fully overwrite it, and something sensitive could remain in some obscure area, like reallocated sectors. Server stores a quite large amount of rather private data I feel really uncomfortable letting go. What if it gets fixed and somebody else ends up recovering my stuff?

Easy solution: Run RAID-5, or R

Re:What I'd like to see (and plan to implement soo

[DamnStupidElf]

echo 0 `/sbin/blockdev --getsize /dev/md0` crypt aes-cbc-essiv:sha256 0102030405060708090A0B0C0D0E0F 0 /dev/md0 0 | /usr/sbin/dmsetup create encrypted_raid

This will take /dev/md0, create an encrypted volume from it using the supplied 16 byte password in hex, and create /dev/mapper/encrypted_raid to mount as your root file system. Replace /dev/md0 and /dev/mapper paths with the appropriate locations your devices for your distro. A combination of pivot_root and chroot can be used to move the mounted encrypt

Re:

[SpecialAgentXXX]

Try using the largest Rare Earth Magnet [wikipedia.org] you can buy. Just be careful to keep it away from every piece of electronic equipment you don't want to damage.

Re:

[Creepy Crawler]

You know, that most state laws put restrictions on the tesla strength a magnet has?

If it has over a certain limit (Mythbusters ran against this limit too), it has to be used only by 'licensed professionals'.

Best bet: create an electromagnet.