The TrueCrypt whole-disk encryption tool used by millions of privacy and security enthusiasts is safer than some studies have suggested, according to a comprehensive security analysis conducted by the prestigious Fraunhofer Institute for Secure Information Technology.
The extremely detailed 77-page report comes five weeks after Google's Project Zero security team disclosed two previously unknown TrueCrypt vulnerabilities. The most serious one allows an application running as a normal user or within a low-integrity security sandbox to elevate privileges to SYSTEM or even the kernel. The Fraunhofer researchers said they also uncovered several additional previously unknown TrueCrypt security bugs.
Despite the vulnerabilities, the analysis concluded that TrueCrypt remains safe when used as a tool for encrypting data at rest as opposed to data stored in computer memory or on a mounted drive. The researchers said the vulnerabilities uncovered by Project Zero and in the Fraunhofer analysis should be fixed but that there's no indication that they can be exploited to provide attackers access to encrypted data stored on an unmounted hard drive or thumb drive. According to a summary by Eric Bodden, the Technische Universität Darmstadt professor who led the Fraunhofer audit team:
It does not seem apparent to many people that TrueCrypt is inherently not suitable to protect encrypted data against attackers who can repeatedly access the running system. This is because when a TrueCrypt volume is mounted its data is generally accessible through the file system, and with repeated access one can install key loggers etc. to get hold of the key material in many situations. Only when unmounted, and no key is kept in memory, can a TrueCrypt volume really be secure. In result, TrueCrypt provides good protection mostly when storing encrypted data offline. If keeping a backup stored offline on a hard drive, for example, or keeping encrypted data on a USB flash drive to be sent via a human carrier, then this can be considered relatively secure.
When random numbers aren't
The analysis, which was performed under contract with Germany's Federal Office for Security in Information Technology, largely echoes the conclusions reached in April in a separate security audit of TrueCrypt. It also uncovered several programming errors, the most serious of which involved the use of a Windows programming interface to generate random numbers used by cryptographic keys. The Fraunhofer researchers also found weaknesses in the way TrueCrypt retrieves random numbers.Theoretically, weaknesses in generating random numbers can make it easier for attackers to guess the secret keys needed to decrypt encrypted data. "To be on the safe side it would therefore be advisable to re-encrypt volumes with a version of TrueCrypt in which this flaw has been fixed," Bodden said. Unfortunately, such a fix may never be available for TrueCrypt since development of the project abruptly ceased 18 months ago when its mostly anonymous developers said the program should no longer be trusted.
April's security audit also uncovered several buffer overflow vulnerabilities. The Fraunhofer researchers said the overflows can't occur at runtime and "thus cannot possibly be exploited." Bodden continued:
In conclusion, I would say that the TrueCrypt code base is probably alright for the most parts. The flaws we found were minor, and similar flaws can occur also in any other implementation of cryptographic functions. In that sense TrueCrypt seems not better or worse than its alternatives. Code quality could be improved, though, as there are some places that call for a refactoring and certainly for better documentation. But generally the software does what it was designed for.
Note that the original designers documented all along a threat model stating that TrueCrypt cannot actually properly protect data on a running system. This matches our findings. If such protection is desired, one cannot get around solutions that use smartcards or other hardware-based key storage such that the encryption key can be better kept a secret. Also such systems can be broken, but they raise the bar significantly.
The conclusion means that the millions of people who have relied on TrueCrypt will probably have a grace period to safely continue using the program until VeraCrypt or another TrueCrypt replacement is farther along in development. The current state of TrueCrypt—with its lack of updates and vague but alarmist warning from developers—is by no means ideal. The added assurances from Fraunhofer at least buys users time until a suitable alternative is available.
Listing image by University of Illinois
reader comments
79