Image source: http://www.eweek.com/imagesvr_ez/b2bezp/2016/09/041814security201406.jpg?alias=slideshow_image
Last year, very surprisingly, the creators of this open source disk encryption program shut down the product. They even posted a warning note on their official website that the tool is no more secured for use. They revealed that they were no more maintaining the tool, and hence it wont receive any security updates. They even asked the users of TrueCrypt to switch to alternative options like BitLocker.
Why the Tool Got Disclosed?
The developers of the tool didnt mention any specific reason to support the closing of the program. There were many rumors surrounding the cause of the sudden shutter down for the program. One of the rumors was that there was some very serious security flaw in the tool. The flaw was grave and could be exploited ruthlessly to risk the encrypted volumes. But the tool was influential and important enough to receive auditing. When the tool got officially abandoned, and users were asked to get their TrueCrypts encrypted data moved to other file encryption program, a publicized security audit of the software began. NCC group did this audit, and the results were published under Open Crypto Audit Project TrueCrypt. Since, its codes were open source, so auditing it was not difficult.
The Results of the Security Audit
1. No Major Security Flaw
The audit results perplexed the auditing team as they didnt find anything to explain why TrueCrypts authors bolted the software all of sudden. The auditing team didnt announce the program as a perfect or completely secured program, but they also couldnt highlight any evidence of a critical flaw that would have compromised the security of the encrypted volumes. As mentioned above, the results of the audit got published, and it is easily available for download on the Internet. The auditing team didnt test every single feature of the program. Its core focus was on encryption/decryption capabilities. The parameters for the audit are as follows:
EncryptDataUnits & DecryptDataUnits and resulting function calls
Key Derivation (derive_key_* from EncryptionThreadProc)
EncryptBuffer and DecryptBuffer
The cascade constructions and AES in XTS Mode
ReadVolumeHeader
2. Detected Flaws
It is also true that the auditing team did detect certain flaws. Four detected flaws were taken as serious, and arguably the most serious of them was about a silent failure of the CryptAcquireContext function. CryptAcquireContext is a process that generates random numbers. But if the hard drive encryption tool is installed on a system that has certain Group Policy Restrictions, then CryptAcquireContext may get failed. Not just that, but it may also fall back and insecure the sources of random number generation.
The second most risk flaw was that the TrueCrypts AES reliability in regards to look-up tables was at risk of so-called cache timing attacks. It means an attacker may succeed in extracting AES keys that got used to protect encrypted volumes.
The other two security flaws are less risky issues, and can get corrected easily. Thus, these are not worth as fundamental threats to the core operation of the program.
Conclusion
The audit team came to the conclusion, based on the audit results, that this hard drive encryption software is a relatively well-designed piece of crypto software. The NCC audit didnt find any severe design flaw or evidence of deliberate backdoors that can make the software insecure. NCC audit was the second audit for this program. Even the TrueCrypts forks such as Ciphershed and VeraCrypt havent been audited yet. Probably the original developers of TrueCrypt could foresee some yet-undiscovered backdoor.
However, since the software is not receiving any security updates, it may develop security flaws although currently it doesnt have any severe security flaw. It is not wise to use software that it not under maintenance. Thus, users can start using the TrueCypts forks like VeraCrypt and Ciphershed or the OS inbuilt file encryption programs such as BitLocker, FileVault, etc.
