Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Audits

TrueCrypt Not Plagued by Backdoors, Severe Design Flaws: Auditors

The TrueCrypt audit that started in October 2013 has been completed. According to the auditors, there aren’t any backdoors or severe design flaws in the popular file and disk encryption software.

The TrueCrypt audit that started in October 2013 has been completed. According to the auditors, there aren’t any backdoors or severe design flaws in the popular file and disk encryption software.

The first phase of the audit, carried out by iSEC Partners, revealed eleven security issues, but no backdoors or malicious code. However, in May 2014, shortly after the first phase of the audit ended, TrueCrypt’s anonymous developers abandoned the project and advised users to migrate to other solutions. They warned users that TrueCrypt was not secure.

TrueCrypt supporters are trying to keep the project alive and the initiators of the audit are confident that the review will be useful to those who might continue work on the encryption software.

The second phase of the audit, which focused on cryptography, was carried out by NCC Group.

“The NCC audit found no evidence of deliberate backdoors, or any severe design flaws that will make the software insecure in most instances,” explained Matthew Green, a cryptography expert and one of the initiators of the Open Crypto Audit Project. “That doesn’t mean Truecrypt is perfect. The auditors did find a few glitches and some incautious programming — leading to a couple of issues that could, in the right circumstances, cause Truecrypt to give less assurance than we’d like it to.”

Auditors have identified a total of four vulnerabilities, two of which have been rated as “high severity,” one as “low severity,” and one as “undetermined severity.” However, NCC noted that none of the issues led to a complete bypass of confidentiality in common usage scenarios.

According to Green, the most severe issue is related to the use of the Windows API for generating random numbers. The random number generator (RNG), which is responsible for creating encryption keys, collects unpredictable values from system pointers, mouse movement, the Windows Crypto API, and other sources.

The problem is that the Windows API fails to properly initialize in certain circumstances. Fortunately, Green says the likelihood of failure is low and the values collected from other sources are enough to provide protection. However, the expert noted that the issue should be addressed in TrueCrypt forks.

Auditors have also determined that some Advanced Encryption Standard (AES) implementations used in TrueCrypt might be vulnerable to cache-timing attacks.

“Additionally, [the NCC Cryptography Services group] identified that volume header decryption relies on improper integrity checks to detect tampering, and that the method of mixing the entropy of key files was not cryptographically sound,” NCC said in its report.

NCC advises those who plan on creating new encryption software based on the TrueCrypt codebase to continue reviewing and improving the code, simplify application logic to make it easier to review, and perform more aggressive error handling and logging.

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

Audits

Out of the 335 public recommendations on a comprehensive cybersecurity strategy made since 2010, 190 were not implemented by federal agencies as of December...

Application Security

Electric car maker Tesla is using the annual Pwn2Own hacker contest to incentivize security researchers to showcase complex exploit chains that can lead to...

Application Security

Software maker Adobe on Tuesday released security patches for 29 documented vulnerabilities across multiple enterprise-facing products and warned that hackers could exploit these bugs...

Application Security

Fortinet on Monday issued an emergency patch to cover a severe vulnerability in its FortiOS SSL-VPN product, warning that hackers have already exploited the...

Application Security

Big-game malware hunters at Volexity are shining the spotlight on a sophisticated Chinese APT caught recently exploiting a Sophos firewall zero-day to plant backdoors...

Application Security

Computer maker Lenovo has started pushing security patches to address three vulnerabilities impacting the UEFI firmware of more than 110 laptop models.

Application Security

Microsoft on Tuesday pushed a major Windows update to address a security feature bypass already exploited in global ransomware attacks.The operating system update, released...

Application Security

Microsoft’s security patching machine hummed into overdrive Tuesday with the release of fixes for at least 97 documented software vulnerabilities, including a zero-day that’s...