SoylentNews is people
SoylentNews
VeraCrypt security audit reveals many flaws, some already patched [Zeljka Zorz/Helpnet Security]
VeraCrypt, the free, open source disk encryption software based on TrueCrypt, has been audited by experts from cybersecurity company Quarkslab.
The researchers found 8 critical, 3 medium, and 15 low-severity vulnerabilities, and some of them have already been addressed in version 1.19 of the software, which was released on the same day as the audit report.
The code auditing effort analyzed VeraCrypt 1.18 and its bootloaders.
"A first step consisted in verifying that the problems and vulnerabilities identified by iSec and NCC Group in TrueCrypt 7.1a for the Open Crypto Audit Project had been taken into account and fixed," the Quarkslab researchers involved in the effort explained.
"Then, the remaining study was to identify potential security problems in the code specific to VeraCrypt. Contrary to other TrueCrypt forks, the goal of VeraCrypt is not only to fix the public vulnerabilities of TrueCrypt, but also to bring new features to the software."
A short overview of the issues found (fixed and still not fixed) can be found here. The audit report, with mitigations for still unpatched vulnerabilities, can be downloaded from here.
Are any Soylentils using Veracrypt and/or other forks of Trucrypt?
The full audit report: TrueCrypt Cryptographic Review[PDF] [Alex Balducci, Sean Devlin, Tom Ritter/Open Crypto Audit Project]
Previously:
Independent Audit: Newly Found TrueCrypt Flaw Allows Full System Compromise
No Backdoors Found in TrueCrypt
TrueCrypt Site Encodes Warning about NSA Infiltration
TrueCrypt Discontinued, Compromised?
-- submitted from IRC
(Score: 1) by Francis on Thursday October 27 2016, @12:18AM
Because Truecrypt is known to have exploits, we still don't know why they suddenly abandoned it and the developers of Veracrypt appear to be taking things seriously and were cooperating with the audit. I'm sure they'll fix whatever the audit before too long.
OTOH, at some point you do have to make the switch, given the highly unusual way in which Truecrypt ended it's existence, I wouldn't personally trust it further than I could throw the developers. I don't use Veracrypt either, but I haven't used Truecrypt a single time since the project was shuttered other than to remove my files from it.
What's more, the security of the software is usually less of a problem than the security of the users and if they're so dense that IT was worried about them making this transition, that doesn't speak well about them.
(Score: 2) by lgw on Friday October 28 2016, @12:36AM
Because Truecrypt is known to have exploits
What practical exploits is Truecrypt known to have? The audit didn't find any, beyond "short passwords aren't safe".
OTOH, at some point you do have to make the switch, given the highly unusual way in which Truecrypt ended it's existence
I trust audits over speculation. I believe the devs ended the project to prevent exploits being added, when pressure was brought to bear on one of them by a government. It's certainly possible that it has an exploit no one found yet, and the government pressured a dev to keep it secret, but that's possible with any tool, so what can we trust beyond audits (and hope they aren't also compromised)?
(Score: 1) by Francis on Friday October 28 2016, @02:36PM
How quaint, you've still got faith in humanity.
The truth here is that we don't know why they up and stopped development suddenly. I can't think of any other projects like this that were abandoned so quickly with no explanation or signs ahead of time. It is speculation, but it's certainly a safer speculation than your far less likely view that there's an exploit that the government wanted kept secret.
Ultimately, do what you want, but it's ridiculous to use questionable encryption technology under this sort of circumstance. The Veracrypt folks will fix those bugs and do you really want to be the one whose stuff gets broken into because somebody made one of those impractical exploits practical?
Also, read the audit, but if the data is worth encrypting, then it's worth encrypting with something secure and supported.
(Score: 2) by lgw on Saturday October 29 2016, @12:56AM
Fundamentally, I don't trust the Veracrypt guys yet.