5

I like TrueCrypt because its easy to use, the filenames can't be viewed unless you decrypt them.

My questions are:

a) Is there any other encryption software better than TrueCrypt that provides better encryption?

b) Can TrueCrypt be cracked? By bruteforce or whatever methods hackers/crackers use.

Ctroy
  • 761

3 Answers3

6

According to http://en.wikipedia.org/wiki/TrueCrypt#Operation_Satyagraha and providing a secure password it it quite safe:

In July 2008, several TrueCrypt-secured hard drives were seized from a Brazilian banker Daniel Dantas, who was suspected of financial crimes. The Brazilian National Institute of Criminology (INC) tried unsuccessfully for five months to obtain access to his files on the TrueCrypt-protected disks. They enlisted the help of the FBI, who used dictionary attacks against Dantas' disks for over 12 months, but were still unable to decrypt them. The case presented a noteworthy real-world test which proved the strength of TrueCrypt.

5

In evaluating any encryption software, there's a lot to consider. To really answer the question for yourself you need to look at the source code, or pay someone to do that for you and accept liability for issuing guarantees to you. Only in that way will you know exactly what the software is doing and whether or not it meets your needs and threat model.

The fact that the source code is available in the first place usually says a lot. If you are paranoid, compile it yourself on a trusted system.

I will say that the algorithms TrueCrypt uses to encipher data are industry standard, not crackable without an impractical amount of computation power (unless you select a poor password) and well used and respected by many who are security conscious. It's not insurmountable that someone could find weakness in AES256 or the other algorithms availble to Truecrypt in the future. This is why TrueCrypt offers cascaded algorithms where you can use multiple algorithms at once, at the cost of speed. Also pick a really long and strong passphrase.

You really should read all the TrueCrypt documentation to ensure you are using it properly, as, for example, the full disk encryption is useless if someone walks up to your machine while you are away and you did not lock your computer. This is also true of any encryption or security product.

LawrenceC
  • 75,182
1

In addition to @ultrasawblade's comments, there are a couple of other things to consider when evaluating TrueCrypt. One of the main alternatives to TrueCrypt (if you're using Windows) is BitLocker. BitLocker can be configured to authenticate against the TPM in your computer, such that a unique key is stored and provided at boot time without you having to know the password. A recovery password is also provided, but it is typically not needed and can be stored in a secure location.

This brings me to the biggest (IMO) weakness with TrueCrypt: it requires users to memorize and repeatedly enter another password. This leaves users' hard drive encryption vulnerable to the most common attack in the world: password compromise. Either by sharing it with others ("Hey, Bob, I'm not there right now, but just get those files off of my computer. Yeah, you can log in with your username and password, but first you have to enter this one at the black screen with the white text--that password is 'password'") or by writing it down on a post-it somewhere easily readable.

The cryptography algorithms used by both TrueCrypt and BitLocker are fairly strong, and would require a lot of resources, both physical (access to the hard drive) and computational to crack, but I prefer BitLocker because it is built according to the philosophy of "your Windows login should be the only security you need, and your hard drive should transparently boot windows if it is in its original computer."

To be sure, there are restrictions in using BitLocker: you have to be running Windows 7 Ultimate or similar and have a TPM-capable computer. It's not without vulnerabilities, either: the recovery passphrase can be stolen (though it doesn't have to be used all the time, so the risk is lower), the TPM can be cracked (unlikely), or the user's Windows login could be compromised.

For more information on full disk encryption software, check out this wiki article.

Zac B
  • 2,903
  • 4
  • 27
  • 39