Things to avoid while using TrueCrypt

Strengthening TrueCrypt: Enhancing Data Security

Using TrueCrypt more safely

TrueCrypt was free, source-available disk encryption software, and its development stopped in May 2014. However, I discovered some important considerations that everyone should be aware of to prevent sensitive data from being exposed. This does not mean that TrueCrypt’s encryption is broken; rather, I will show you how to make it stronger against various attacks.

First of all, TrueCrypt encourages you to use AES (Advanced Encryption Standard) as it is the first on the list (default) and the fastest when you benchmark all available algorithms. Here are some steps to enhance TrueCrypt’s security:

• Choose Stronger Algorithms: While AES is fast and secure, consider using a combination of encryption algorithms (such as AES, Twofish, and Serpent) to provide an additional layer of security.
• Use Complex Passwords: Ensure your passwords are long and complex, combining letters, numbers, and special characters to make them harder to crack.
• Enable Keyfiles: In addition to your password, use keyfiles to add an extra layer of protection. A keyfile is a file whose content TrueCrypt combines with your password to derive the key that protects the volume.
• Regularly Update Software: Keep your encryption software and operating system up to date to protect against newly discovered vulnerabilities (TrueCrypt itself no longer receives updates, which is why VeraCrypt is the safer choice today).
• Physical Security: Ensure the physical security of your devices. No encryption can protect your data if someone has direct access to your hardware.

By following these steps, you can significantly enhance the security of your data when using TrueCrypt.

Password attacks on TrueCrypt containers

Therefore I thought of sharing this information that I recently found while surfing the net. If you ever use AES as your encryption algorithm, be aware that your container can be attacked by TrueCrack and hashcat.

What if you use a combination of three algorithms, will it be a safer option?
Only if you use a strong password, for example “I1WBDQpFp8@”:ve’nOq&b@+2WPL9v7″, can you be sure that your data is safe, because hashkill can brute force any type of algorithm, including a combination of three algorithms!

What if I use a strong combination of algorithms (Serpent-Twofish-AES) and a strong password, am I safe?
Well, if you have password caching enabled in your TrueCrypt settings, then you are not safe once someone gets physical access to your computer!

The reason is that vendors like Passware (the company behind lostpassword.com) and ElcomSoft can retrieve your keys from memory, for example over a FireWire port, by doing the following:

• Analyzing the hibernation file (if the PC being analyzed is turned off);
• Analyzing a memory dump file;
• Performing a FireWire attack (PC being analyzed must be running with encrypted volumes mounted).

The TrueCrypt development team’s deliberately alarming and unexpected “goodbye and you’d better stop using TrueCrypt” posting stating that TrueCrypt is suddenly insecure (for no stated reason) appears only to mean that if any problems were to be subsequently found, they would no longer be fixed by the original TrueCrypt developer team . . . much like Windows XP after May of 2014. In other words, we’re on our own.

Steve Gibson

Downloads

TrueCrypt 7.1a Setup Downloads

• TrueCrypt Setup 7.1a.exe (32/64-bit Windows)
  MD5: 7a23ac83a0856c352025a6f7c9cc1526
• TrueCrypt 7.1a Mac OS X.dmg
  MD5: 89affdc42966ae5739f673ba5fb4b7c5
• Truecrypt-7.1a-linux-x64.tar.gz
  MD5: bb355096348383987447151eecd6dc0e
• Truecrypt-7.1a-linux-x86.tar.gz
  MD5: 09355fb2e43cf51697a15421816899be
• Truecrypt-7.1a-linux-console-x64.tar.gz
  MD5: eb71d8108afec84d4dc72c523b57763a
• Truecrypt-7.1a-linux-console-x86.tar.gz
  MD5: 218d80bbe69cb63dba124efb62600e0f

User Guide

TrueCrypt User Guide.pdf
MD5: 60b1ea96c0dcb7238da39844f0c11910

Source Code

• TrueCrypt 7.1a Source.zip
• MD5: 3ca3617ab193af91e25685015dc5e560

• TrueCrypt 7.1a Source.tar.gz
• MD5: 102d9652681db11c813610882332ae48

Conclusion

• Choosing Serpent, Twofish or a cascade instead of AES does not stop password cracking: tools such as hashcat attack the password, and attack every one of these ciphers alike, so a long, strong password (and in VeraCrypt a higher PIM) is what really protects you.
• A cascade of three algorithms with SHA-512 still guards against a future weakness in one cipher, but only a strong password stops a guessing attack.
• Using a keyfile on its own without a password is not secure.
• Disable FireWire ports, and guard Thunderbolt ports against the same DMA attack (Kernel DMA Protection on Windows).
• Use hidden volumes if possible.
• Use a very strong password, do not share it, and use KeePass to store it.
• Do not cache your TrueCrypt password, and make sure it is cleared on dismount or exit in the settings.
• When creating a container, uncheck the “Show” checkbox in the last dialog and wiggle the mouse for at least 45 seconds.
• TrueCrypt was fully audited by the Open Crypto Audit Project (finished in April 2015, with no evidence of a backdoor): the audit status page is here and the phase one report can be seen here. A good security analysis of TrueCrypt 7.0a can be found here.
• To learn more about encryption, please read this document.
• VeraCrypt is a TrueCrypt fork that strengthened the key derivation used for system and partition encryption, making it far more resistant to brute-force attacks. The VeraCrypt audit can be found here and I strongly recommend moving from TrueCrypt to VeraCrypt.