Truecrypt 5.0a (data encryption)

Support, Discussion, Reviews
Post Reply
User avatar
Winnow
Super Poster!
Super Poster!
Posts: 27726
Joined: July 5, 2002, 1:56 pm
Location: A Special Place in Hell

Truecrypt 5.0a (data encryption)

Post by Winnow »

I wasn't actively looking for it, but somehow I got sidetracked last night and spent several hours researching data encryption.

My findings:

Truecrypt 5.0a is a free open source data encryption solution for Windows, OSX and Linux.

It's capable of encrypting a container file, partition, or even your OS partition and entire drive. The site mentions several reasons why it's a better solution than Bitlocker which I won't get in to.

I've mention the free app called Erasor before which can permanently delete data from your hard drive overwriting the data several times with various random patterns and 0's and 1's depending on how paranoid you are. I've been using that to delete my temp newleecher directory files after sometimes opening questionable files directly from newsleecher. It's a great little app and works well but instead of stressing over random files here and there, I used Truecrypt and created a 100GB file container and located all of my newsleecher downloads, config files, group history storage, temp files, etc inside the container.

A Truecrypt container (as opposed to encrypting an entire partition) can be mounted as a hard drive easily and can be left open as long as the computer is running. It automatically dismounts if the PC is turned off or there's a power outage. The mounted container file is visible to all apps just like any other partition.

I was a little worried about how much encryption would slow things down. Truecrypt has heavy duty encryption options:

Image

Image

After reading up on AES, Twofish and Serpent, it appears they're all excellent 256-bit encryption. If you are off-the-charts paranoid, you can also combine two or all three of them. I wanted the fastest one but accidentally chose Serpent instead of Twofish. It took about 60 minutes to setup a 100GB encryption container. As you can see above (if not red-x'd!), Twofish would have taken about half that time.

Newleecher makes it easy to change locations for the temp file, storage folder, etc so that didn't take long. Basically, I just need to remember to mount the container before using Newsleecher. If I forget, Newsleecher warns you that it can't access the storage locations anyway when it opens so that's a good reminder.

I haven't been able to fully test the speed but so for the few files I downloaded, it seemed ok. It wasn't enough to see if I was getting full transfer speeds etc so will try that out tonight. If anything appears slow, I'll switch to the Twofish encryption option that I originally meant to use.

----

Anyways, Truecrypt has a nice "travel" encryption solution which made me think of the article posted here recently where someone with a notebook traveling across the US/Canada border had an encrypted partition and the authorities were trying to force him to give his password.

Truecrypt has a way for "Plausible Deniability' if this happens to you. In short, you create a hidden encrypted container within a visible encrypted container or partition. Encrypted partitions or containers are always filled with random data when they are created so to someone that doesn't have the key, there's no way to tell that there's a hidden volume within the visible volume. When you attempt to access the visible volume, Truecrypt asks you for your password. Truecrypt will open either the visible or hidden container depending on which password you enter. (of course you create two different passwords).

With this strategy, you would put something like pr0n or a picture of Stragi in the visible container which would appear embarrassing if you were caught with it but not too bad, and then you'd store the actual sensitive data in the hidden container. If forced to give up your password, you'd give the visible container password and there'd be no way to tell that a hidden container exists.

The second "Plausible Deniability" suggestion is to not use the .tc extension for your container. Truecrypt completely ignores the filename and extension for container files. so you could name your file whatever you want and give it any extension you want or no extension at all. Without the .tc extension, there's no cause to believe you have an encrypted container.

-----

Cool stuff. I really don't have anything that interesting to hide but I also don't want to bother with having to erase my temp folder, etc. and figure it couldn't hurt to download everything into an encrypted folder and then move stuff that I want to keep out of it. 100GB is large enough to not have to micromanage it though.

The Truecrypt website has great documentation and also very active forums. It's worth looking into if just to make a little folder for your tax info, identification info and other crap like personal photos, etc.

http://www.truecrypt.org/docs/
User avatar
valryte
Almost 1337
Almost 1337
Posts: 679
Joined: August 28, 2002, 12:58 am

Re: Truecrypt 5.0a (data encryption)

Post by valryte »

Wow, surprised you of all people have never ran across TrueCrypt. Yeah it's really good, I may have used it from time to time...
When the world is mine, your death shall be quick and painless.
User avatar
Siji
Way too much time!
Way too much time!
Posts: 4040
Joined: November 11, 2002, 5:58 pm
Gender: Male
XBL Gamertag: mAcK 624
PSN ID: mAcK_624
Wii Friend Code: 7304853446448491
Location: Tampa Bay, FL
Contact:

Re: Truecrypt 5.0a (data encryption)

Post by Siji »

Sounds like PGP desktop, albeit free.

Court case recently, which I didn't follow so don't know the results, but a man suspected of something or another (child pr0n?) was asked to give up his PGP password for an encrypted drive and refused. Story was something about how it's questionable whether he can be forced to give up the password (something about self incrimination, etc).
User avatar
Ashur
Way too much time!
Way too much time!
Posts: 2604
Joined: May 14, 2003, 11:09 am
Location: Columbus OH
Contact:

Re: Truecrypt 5.0a (data encryption)

Post by Ashur »

I don't think a court or the police can't force you to divulge a password, and since we can't torture it out of you, the most they could do have the judge ask you to do so and charge you you with contempt if you fail to provide it, but I don't think that would pass the legal smell test since they can't force you to provide evidence against yourself.

But it sure is fishy from a circumstantial evidence POV!

Any links on that news article Siji? I always wondered about that since I have encryption on my work laptop (curiosity also piqued by the airport laptop thread elsewhere).
- Ash
User avatar
Aardor
Way too much time!
Way too much time!
Posts: 1443
Joined: July 23, 2002, 12:32 am
Gender: Male
XBL Gamertag: Phoenix612
Location: Allentown, PA

Re: Truecrypt 5.0a (data encryption)

Post by Aardor »

User avatar
Fash
Way too much time!
Way too much time!
Posts: 4147
Joined: July 10, 2002, 2:26 am
Gender: Male
XBL Gamertag: sylblaydis
Location: A Secure Location

Re: Truecrypt 5.0a (data encryption)

Post by Fash »

My thoughts on this... I think it's great and all that there is no file signature on the TC volume, so there is no way to distinguish it from random data... However... How many large files full of random data do you have?... Lol.

If law enforcement has your PC, and you have TrueCrypt installed, it doesn't take a rocket scientist to find your TC volume, regardless of the file extension... The hidden volumes could likely also be detected, once the mounted volume does not match the size of the file. It might be more complicated than that, but I don't think by much.
Fash

--
Naivety is dangerous.
User avatar
Winnow
Super Poster!
Super Poster!
Posts: 27726
Joined: July 5, 2002, 1:56 pm
Location: A Special Place in Hell

Re: Truecrypt 5.0a (data encryption)

Post by Winnow »

Fash wrote:My thoughts on this... I think it's great and all that there is no file signature on the TC volume, so there is no way to distinguish it from random data... However... How many large files full of random data do you have?... Lol.

If law enforcement has your PC, and you have TrueCrypt installed, it doesn't take a rocket scientist to find your TC volume, regardless of the file extension... The hidden volumes could likely also be detected, once the mounted volume does not match the size of the file. It might be more complicated than that, but I don't think by much.
Them finding it isn't the problem. "Plausible Deniability" is what the goal is. a .tc link would directly link the file to Truecrypt while a huge random data file is simply that.

I like the hidden volume within a visible volume strategy myself. While the size of the file is large and there might only be a few pictures in the visible container, how can anyone possible prove there's also a hidden container? Random data always fills all the space whether it's empty or full (well there'd be envrypted data then but no way to tell the difference)

If you're a businessman and have sensitive data (new product, corporate strategies, etc), I wouldn't want anyone reading over that data because they demand a password. A couple nudy pics will satisfy the inspector (don[t even have to be (c) pics. They can just be family photos you don't want out in public if you lose your laptop.

So far, even Serpent encryption, I've notices no slowdown while using Newsleecher. (try Two-Fish though)
User avatar
Fash
Way too much time!
Way too much time!
Posts: 4147
Joined: July 10, 2002, 2:26 am
Gender: Male
XBL Gamertag: sylblaydis
Location: A Secure Location

Re: Truecrypt 5.0a (data encryption)

Post by Fash »

Winnow wrote:
Fash wrote:My thoughts on this... I think it's great and all that there is no file signature on the TC volume, so there is no way to distinguish it from random data... However... How many large files full of random data do you have?... Lol.

If law enforcement has your PC, and you have TrueCrypt installed, it doesn't take a rocket scientist to find your TC volume, regardless of the file extension... The hidden volumes could likely also be detected, once the mounted volume does not match the size of the file. It might be more complicated than that, but I don't think by much.
Them finding it isn't the problem. "Plausible Deniability" is what the goal is. a .tc link would directly link the file to Truecrypt while a huge random data file is simply that.

I like the hidden volume within a visible volume strategy myself. While the size of the file is large and there might only be a few pictures in the visible container, how can anyone possible prove there's also a hidden container? Random data always fills all the space whether it's empty or full (well there'd be envrypted data then but no way to tell the difference)

If you're a businessman and have sensitive data (new product, corporate strategies, etc), I wouldn't want anyone reading over that data because they demand a password. A couple nudy pics will satisfy the inspector (don[t even have to be (c) pics. They can just be family photos you don't want out in public if you lose your laptop.

So far, even Serpent encryption, I've notices no slowdown while using Newsleecher. (try Two-Fish though)
It is not plausible. If you have TrueCrypt installed, and a 100 GB giant file full of random data (which is likely to be the only non-identifiable file on your system), it is not plausible that you can deny it is a TrueCrypt volume. This does not pass the smell test, and I doubt it would pass a legal test.

As for the hidden volume trick... If I'm able to mount the visible volume, then I should be able to fill it, right? :) I bet I can't fill it if there's a hidden volume... Like I said, It might not be that simple, but I know it's not that difficult.
Fash

--
Naivety is dangerous.
User avatar
Aabidano
Way too much time!
Way too much time!
Posts: 4861
Joined: July 19, 2002, 2:23 pm
Gender: Male
Location: Florida

Re: Truecrypt 5.0a (data encryption)

Post by Aabidano »

With the results of that court case, you don't have to give your password, so hiding the volume isn't needed. A "None of your business" response as to what the contents are might make you look guilty, but isn't something you can be prosecuted for either. If they have the drive, you can't really hide anything, you can only make the data non-usable.

In the business scenario, leave the files on a corporate server, and get them via VPN when you need to at your destination. And make sure you nuke them and any temporary copies before you leave. Software like Truecrypt is illegal in many countries, and illegal to "export" to others so you need to be careful.

Worst case encrypt the files you need for the trip and put the keys on a USB dongle that you mail ahead to your hotel. Or have a co-worker email or overnight you the keys once you get there. If someone demands the keys "I don't have them" works pretty well unless you're in much deeper doodoo than your average customs check.

*Edit - Having keys and no passphrase it's only a matter of time (possibly years) until they can access the contents. With no keys and any halfway decent encryption method they won't be getting access, ever. Some of the older\faster encryption methods that have been been "broken" were done by people using massively parallel custom processors. So unless you've aggravated the NSA or someone with connections at Purdue or MIT you really don't have much to fear.
"Life is what happens while you're making plans for later."
User avatar
Winnow
Super Poster!
Super Poster!
Posts: 27726
Joined: July 5, 2002, 1:56 pm
Location: A Special Place in Hell

Re: Truecrypt 5.0a (data encryption)

Post by Winnow »

wanted to give an update on my experiences with Truecrypt after having used it for three weeks.

Don't remember if I mentioned this above, but I created a 100GB container file and chose Serpent for the encryption. I have my Newsleecher directories setup to save directly to the mounted, encrypted partition. I also have Picaloader set up to save all the image sites I rip directly to the encrypted folder.

After checking properties, it looks like I've downloaded around 140K images to the encrypted partition. I've also grabbed several 360 images along with the usual movies, etc. I've unrar'd several huge 7GB 360 image files and noticed no slowdown by doing so from the encrypted partition. There have been no problems downloading mass image collections at high speed where the HD has to work hard to keep up. I've had multiple directories with 20K images in a single directory and have moved them within the encrypted partition, used flexible renamer to mass rename 10-20K images all at once.

None of the above was slowed down by the encryption and that's after I accidentally chose the more robust (and a little slower) serpent encryption instead of AES of Twofish which I really wanted.

Truecrypt has been hassle free. I only need to mount the container file after a reboot. It stays mounted otherwise unless I choose to unmount it. There is a way to save your "favorites" so I can load Truecrypt and select "mount favorite volumes" and only need to enter the password for it to select the same drive letter and mount (so apps like Newsleecher will save to the same drive letter that you set in preferences). My password is over 20 characters in length but easy enough to remember while being near impossible to crack.

Summary:

Truecrypt is very easy to use, doesn't cause slowdowns, and is a great safety measure that can easily contain everything you download before you are able to browse through and determine what's safe to keep, or delete something that's questionable. On a smaller scale, it's a no brainer for your personal photos and documents. If I forget to load my encrypted partition, the first time I load newsleecher I know as it says it can't located my chosen save directory. BTW, Newsleecher will still work but save the files to its default directory.
Post Reply