TrueCrypt 5.0 Released, Now Encrypts Entire Drive 330
A funny little man writes "The popular open source privacy tool, TrueCrypt, has just received a major update. The most exciting new feature provides the ability to encrypt an entire drive, prompting the user for a password during boot up; this makes TrueCrypt the perfect tool for non-technical laptop users (the kind who are likely to lose all of that sensitive customer data). The Linux version receives a GUI and independence from the kernel internals, and a Mac version is at last available too."
Re:Slashdotted? (Score:2, Informative)
Re:Independence from Kernel Internals? (Score:5, Informative)
Re:if truecrypt.org is still down (Score:2, Informative)
Download here (as the site seems down atm) (Score:3, Informative)
Press release here [sourceforge.net].
We are pleased to announce that TrueCrypt 5.0 has been released. Among the new features are the ability to encrypt a system partition or entire system drive (i.e. a drive where Windows is installed) with pre-boot authentication, pipelined operations increasing read/write speed by up to 100%, Mac OS X version, graphical interface for the Linux version, XTS mode, SHA-512, and more.
After four years of development, during which millions of people downloaded a copy of TrueCrypt, it is the only open-source disk encryption software that runs on Windows, Mac OS X, and Linux. The newly implemented ability to encrypt system partitions and system drives provides the highest level of security and privacy, as all files, including any temporary files that Windows and applications create on system drives (typically, without the user's knowledge or consent), swap files, etc., are permanently encrypted. Large amounts of potentially sensitive data that Windows records, such as the names and locations of files opened by the user, applications that the user runs, etc., are always permanently encrypted as well. For more information, please see http://www.truecrypt.org/docs/?s=version-history [truecrypt.org]
Re:if truecrypt.org is still down (Score:4, Informative)
You Fail It.
Re:Slashdotted - Download Mirror on Filehippo (Score:5, Informative)
Re:if truecrypt.org is still down (Score:3, Informative)
Re:What about wake up? (Score:5, Informative)
This forces you to re-enter your password to access the volume.
Of course, you should have an option in your OS to ask you for your login password whenever you close and then open your lid as well.
Re:Slashdotted (Score:4, Informative)
Re:What about wake up? (Score:3, Informative)
Normally this wouldn't offer complete protection - you could just reboot from a system disk and access the filesystem, but with truecrypt (or FileVault, or any of the other encrypted file system solutions) they can't do this.
Re:Mirror, mirror, on the wall... (Score:3, Informative)
Re:Slashdotted (Score:2, Informative)
Re:Independence from Kernel Internals? (Score:5, Informative)
Re:Independence from Kernel Internals? (Score:3, Informative)
Your concept of impossible is, of course, a little bit flawed, for I have at least 5 *entire* disks encrypted in this single box I am writing on. And some of them has no partitions, just a filesystem over raw disk.
Re:The final excuse. (Score:5, Informative)
Re:Independence from Kernel Internals? (Score:5, Informative)
Of course you can. You just can't have an encrypted MBR... unless you boot from a floppy or a USB drive you keep on your person, or something like that. Note that bios limitations can also be circumvented with linuxbios
Re:Independence from Kernel Internals? (Score:5, Informative)
I am not a TrueCrypt expert, but I follow the discoveries of the crypto community. It seems TrueCrypt is highly respected. While it cannot defeat a (hardare in this case) keylogger, the crypto used seems to be strong crypto implemented according to current standards. Not a snake-oil product with home-rolled ciphers or "passwordless" security or such nonsense. At the moment, nobody admits being able to breaking it and I am not aware of instances that indicate it has been broken. And, other than many other products, it is widely used. Personally I would say it is on a level with PGP/GnuPG/dm-crypt/LUKS with regard to security level offered.
Re:if truecrypt.org is still down (Score:5, Informative)
February 5, 2008
New features:
*
Ability to encrypt a system partition/drive (i.e. a partition/drive where Windows is installed) with pre-boot authentication (anyone who wants to gain access and use the system, read and write files, etc., needs to enter the correct password each time before the system starts). For more information, see the chapter System Encryption in the documentation. (Windows Vista/XP/2003)
*
Pipelined operations increasing read/write speed by up to 100% (Windows)
*
Mac OS X version
*
Graphical user interface for the Linux version of TrueCrypt
*
XTS mode of operation, which was designed by Phillip Rogaway in 2003 and which was recently approved as the IEEE 1619 standard for cryptographic protection of data on block-oriented storage devices. XTS is faster and more secure than LRW mode (for more information on XTS mode, see the section Modes of Operation in the documentation).
Note: New volumes created by this version of TrueCrypt can be encrypted only in XTS mode. However, volumes created by previous versions of TrueCrypt can still be mounted using this version of TrueCrypt.
*
SHA-512 hash algorithm (replacing SHA-1, which is no longer available when creating new volumes).
Note: To re-encrypt the header of an existing volume with a header key derived using HMAC-SHA-512 (PRF), select 'Volumes' > 'Set Header Key Derivation Algorithm'.
Improvements, bug fixes, and security enhancements:
*
The Linux version of TrueCrypt has been redesigned so that it will no longer be affected by changes to the Linux kernel (kernel upgrades/updates).
* Many other minor improvements, bug fixes, and security enhancements. (Windows and Linux)
If you are using an older version of TrueCrypt, it is strongly recommended that you upgrade to this version.
4.3a.......
==============
System Encryption
TrueCrypt can on-the-fly encrypt a system partition or entire system drive, i.e. a partition or drive where Windows is installed and from which it boots (a TrueCrypt-encrypted system drive may also contain non-system partitions, which are encrypted as well).
System encryption provides the highest level of security and privacy, because all files, including any temporary files that Windows and applications create on the system partition (typically, without your knowledge or consent), swap files, etc., are permanently encrypted. Windows also records large amounts of potentially sensitive data, such as the names and locations of files you open, applications you run, etc. All such log files and registry entries are always permanently encrypted as well.
System encryption involves pre-boot authentication, which means that anyone who wants to gain access and use the encrypted system, read and write files stored on the system drive, etc., will need to enter the correct password each time before Windows boots (starts). Pre-boot authentication is handled by the TrueCrypt Boot Loader, which resides in the first cylinder of the boot drive.
Note that TrueCrypt can encrypt an existing unencrypted system partition/drive in-place while the operating system is running (while the system is being encrypted, you can use your computer as usual with
Linux 64bit? (Score:3, Informative)
Re:Independence from Kernel Internals? (Score:5, Informative)
Oh, I forgot to mention. According to their website, TrueCrypt can encrypt the boot partition even after the OS is installed, even with Windows.
Basically, you install it, then you ask it to encrypt the whole disk. It will install the boot code to ask the password and decrypt the partition before loading the OS, and then it will start encrypting your partition in the background, you may continue using the OS. You may even reboot the machine, it will boot correctly and continue encrypting from where it stopped. If it really works as they say it does, this version is indeed amazing.
Re:Slashdotted (Score:5, Informative)
Re:download link NOT (Score:2, Informative)
Re:Hard Drive Read/Write Times (Score:3, Informative)
Random accesses arent slowed down noticable, but large STR (like copying 50Gbyte to another HD) are. For me, the limit was about 30Mbyte/s.
But as this is driver-level CPU load, and not interupt driven, the system responsitivity was not negatively affected.
Memory usage is neglectable, and CPU load scales linearly with bytes/s. So in most scenarios, or multicores, its not the limiting factor.
But you would NOT want to capture video or stuff like that onto a truecrypt volume
Re:OT -- what's the state of flash encryption? (Score:4, Informative)
It does install a system driver when in use, but the driver can reside purely on the unencrypted portion of the flash drive.
James
Re:Risky? (Score:2, Informative)
I also duel boot windows / linux, and ran into the following errors tryin to set it up with TC
You can't encrypt the whole drive if you have more than 1 OS on 1 drive (not partition)
You can encrypt only your windows partition, but ONLY if you are using the windows boot manager in your MBR, and move grub to your linux partition.
If you have 2 drives, 1 for windows and 1 for linux, you should be home free.
Guess i'll stick to encrypted volumes
Re:Independence from Kernel Internals? (Score:3, Informative)
Re:Slashdotted (Score:3, Informative)
Re:FIPS 140-2? (Score:3, Informative)
The algorithms used are fine, but this stamp of approval would be very useful for federal Linux and Mac users!
http://www.extrapepperoni.com/2007/09/10/fips-140-2-for-mac-os-x/
Filevault already provides FIPS 140-2 compliant encryption.
Re:The final excuse. (Score:2, Informative)
From their FAQ: [truecrypt.org]
Q: I forgot my password - is there any way to recover the files from my TrueCrypt volume?
A: TrueCrypt does not contain any mechanism or facility that would allow partial or complete recovery of your encrypted data without knowing the correct password or the key used to encrypt the data. The only way to recover your files is to try to "crack" the password or the key, but it could take thousands or millions of years depending on the length and quality of the password/keyfiles, on software/hardware efficiency, and other factors.
Re:ZFS Encryption (Score:3, Informative)
Re:Independence from Kernel Internals? (Score:3, Informative)
If it runs while loading the OS (kernel), and then runs when that OS mounts a filesystem, it must be running in two different places since in one case the I/O is done through BIOS calls and in the other case through device driver calls in a kernel. That doesn't sound like independence from the kernel to me. It sounds like it has to be compiled into the kernel (otherwise the / filesystem isn't encrypted), or at least inside initramfs (which is still compiled into the kernel).
I'm really not concerned about the install process. I'm concerned about reliability aspects, including the ability to support the way I structure my file systems. Performance would be good, too, but there is obviously a certain amount of performance hit for the encryption. For example, things like direct write should still continue to work faster, by doing the encryption of data blocks directly from the original buffer to a temporary (not copy to a temporary first), then completing the write.
Re:Independence from Kernel Internals? (Score:2, Informative)
Re:Slashdotted (Score:2, Informative)
- Anybody with admin rights to the machine can remove the FDE (And even though the FDCC guidelines (Which all government agencies are supposed to follow and implement as of Jan 31, 2008 (yea right)) [nist.gov] say this is a no-no, all it takes is someone, somewhere to sign off saying "We allow local admin rights because: " and viola! Admin rights.
- No support for two factor authentication.
- No support for the "I forgot my password" syndrome beyond saying: Here is a rescue CD, and here is the password, and have fun! Commercial products allow for a challenge-response one time login/password change request.
- No support for multiple users to log in to the laptop (Ties into the point above).
- No support for policies (Password length/complexity, time restrictions, that sort of thing)
- No support for automatic updates (which I guess is a moot point because of the above issue)
- No support for automatically updating the header files (Needed when the user changes password, a new user is given rights to the machine, etc.)
- And the biggest one: Truecrypt would need to have a champion at the highest levels before it has a chance of being deployed.
Some of these problems also prevent Truecrypt from being used as a portable media encryption option in the government as well. For example there is no easy way that a end user can create a container and say "Only myself and Bob can open it".In short, it is close to being useful beyond the SOHO market, but not quite there. Reading through there todo's I see that they are going to be addressing some of these issues, and I suspect that with enough constructive input, they will eventually meet the other requirements as well.
Re:The final excuse. (Score:3, Informative)
Also, yes you CAN recover truecrypt volumes if you lose the password. If you backup the volume header and store that with a password, you may later get back at your data by restoring the volume header.
That FAQ is either out of context or out dated. I've recovered TC volumes using volume headers.
Re:What about wake up? (Score:1, Informative)
The problem is that the image of your RAM is not encrypted (in Tiger, at least; I'm not sure about Leopard). The RAM needs to have your crypto keys in it in order to read from and write to the FileVault volume. Pull the drive, find the sleepimage file (it's in
Further, someone who really knows what he's looking at might be able to just find the key outright and wouldn't need the password.
Re:What about wake up? (Score:3, Informative)
- user logs off
- screen saver is started
- enters power saving mode
- no data has been written for x minutes
Dismounting can be forced even if there are open files on the volume. All those options were there even in TrueCrypt 4.3.Not anytime soon. (Score:3, Informative)
In any case it costs a lot of money and they only test binaries which makes anything that links into a kernel difficult unless it's only a library core common among implementations which is linked at install time or something.
It's a real pain.
Most people are fine with FIPS-compliant but not listed, and not many government types use anything but windows on laptops, so you're kinda screwed there being one of very few who need it.
Re:Recovery CD (Score:4, Informative)
They've really thought this through. I've gotta hand it to the people at Truecrypt.org. I'm impressed, especially considering this is the first release of their whole disk encryption product.
Re:Recovery CD (Score:1, Informative)