TrueCrypt Primer: Part 1 – What It Is & Why You Should Care

[PAGETITLE=Introduction][Top Ad] Data has never been such a traveler. In our mobile devices, flash drives, computer desktops, on the Internet and in the multitude of cloud services, data is constantly being downloaded, uploaded, or synced. Data that we have generated ourselves - like a spreadsheet for a financial report, work we brought home from the office, our photo albums and more. If something has to be said about data these days, it's that never before has data security been such an important consideration for humankind. We've been experiencing the Internet through the filter of user names and passwords. Almost anywhere we go we are required to sign up for a new account, or sign in to an existing one if we have been there before and have already left our credentials stored on the website or Web database. But if passwords and usernames offer some amount of security, it's just a modicum dose. I would go as far to argue that passwords aren't a security measure at all; they are data like any other that needs to be secured and merely offers an authentication method to an in-place security measure. As such, true security derives from how we store the actual data, including passwords. In modern times this has become an absolute imperative and anyone using the Internet should at one time or another become familiar with any security measures to protect their data. Encryption is one such measure and the most widespread. A General Look at TrueCrypt. In this three-part series, we are going to take a deep look at TrueCrypt. TrueCrypt is a free software tool that's been developed since 2004 and is made available by the TrueCrypt Foundation. With this tool it is possible to create a virtual encrypted disk within a file, or encrypt a partition. Under Windows it is also possible to encrypt the entire boot drive. As of this writing, TrueCrypt's latest version is 7.1a. The three articles in this series will refer to this version. TrueCrypt is available for Windows, Linux and MacOs X operating systems — but what you can do with it depends on the type and version of your operating system. Virtual Disks Partition Encryption System Encryption Windows 8 (32 & 64 bits) 1 Yes No Windows 7 (32 & 64 bits) Yes Yes Windows Vista (32 & 64 bits) 2 Yes Yes Windows XP (32 & 64 bits) Yes Yes Windows Server 2008 R2 Yes Yes Windows Server 2008 (32 & 64 bits) Yes Yes Windows Server 2003 (32 & 64 bits) Yes Yes Mac OS X 10.7 Lion (32 & 64 bit) Yes No Mac OS X 10.6 Snow Leopard (32 bits) 3 Yes No Mac OS X 10.5 Leopard (32 bits) 3 Yes No Mac OS X 10.4 Tiger (32 bits only) Yes No Linux Kernel 2.6 or compatible (32 & 64 bits) Yes No 1 The TrueCrypt website makes it clear Windows 8 isn't fully supported yet. Despite any success you might have encrypting a Windows 8 system partition, this is not recommended until full Windows 8 support is given on a future version of TrueCrypt. 2 System partition encryption is only possible with Windows Vista SP1 or above. 3 64 bit support can be obtained by installing OSXFUSE. You can see from the table above that Linux-based systems don't support system encryption. This is due to the OS design. Such a feature would have to be able to handle Linux-supported filesystems (at least the most widely used ext3, ext4, etc). It would also need to support more than one bootloader and be intelligent not to destroy their rules when placing its own. It would also need to locate and encrypt the distinct swap volume. While doable, the amount of work required may mean TrueCrypt will never provide support for Linux system encryption. TrueCrypt main window TrueCrypt supports the following encryption algorithms: AES Serpent Twofish In addition, TrueCrypt supports Multiple Encryption. This technique (also known as Cascade) encrypts data using multiple encryption algorithms in succession. (The file is first encrypted with one algorithm, and then another encryption takes place on top of the previous one with another algorithm). The supported Cascades are: Serpent-AES. Twofish-Serpent. AES-Twofish-Serpent. Serpent-TwoFish-AES. The cryptographic hash algorithms supported by TrueCrypt are: RIPEMD-160 SHA-512 Whirlpool Algorithms and hash functions will be discussed in more detail on the second part of this series. [PAGEBREAK][PAGETITLE=TrueCrypt Volumes][Top Ad] TrueCrypt uses the concept of virtual disk volumes to help create, use and manage encrypted data. TrueCrypt volumes behave exactly as if a new disk drive had been installed on the system and, once mounted, can be accessed through normal file browsing tools (Windows Explorer, Mac Os X Finder and Linux ls command, for instance). When you require a file or folder/directory to be encrypted, you simply mount your TrueCrypt volume of choice and move the file or folder/directory inside there. For all purposes, a TrueCrypt volume, once mounted, is entirely transparent to the user and the operating system makes no distinction between it and a regular disk drive on your computer. In parts II and III of this series you are going to learn exactly how these volumes are created and managed. TrueCrypt's interface makes this a simple procedure. TrueCrypt makes a distinction between three different volume types: File Hosted Volumes, Partition Hosted Volumes and Pre-Boot Authentication Volumes. The three types of TrueCrypt Volumes File Hosted volumes (known also as Containers) are virtual disk volumes represented by a single file on your computer, very similar to mounting an ISO file as a virtual drive on your computer. These volumes are the ideal choice if you do not want to encrypt the entire device or disk partition, but wish to have a file containing encrypted data inside. By far, this is the most common usage of TrueCrypt. File Hosted Volumes are an excellent option for sensitive or personal data that you wish to store in cloud-based Internet services like DropBox, SkyDrive or Google Drive. File hosted volumes are normal operating system files until they are mounted. They can be copied, moved or deleted just like any other file. Partition Hosted Volumes (or Device Hosted Volumes, if the device contains only one partition) is a disk partition or an entire storage device encrypted by TrueCrypt. These partitions or devices become unrecognizable by the operating system and must be mounted with TrueCrypt before they can be used. This is an ideal choice when you want to encrypt an entire USB memory stick or other external storage devices. It is also the volume you should create when you wish to have an encrypted hard drive (or partition) for the single purpose of storing any sensitive data. Pre-Boot Authentication Volumes are used when you wish to encrypt the entire system drive where Windows resides. They aren't volumes per se since they aren't mounted on a running operating system, But allow me to make the distinction since, on the case of system partition, TrueCrypt refers to it simply by the process name (System Encryption) and doesn't name the resulting encrypted partition. System encryption is discussed in more detail in part III of this series. Plausible Deniability. TrueCrypt introduces in its arsenal of security features the concept of Plausible Deniability. The term refers to the ability of denying the existence of any encrypted data when being forced to reveal its authentication password under threat. TrueCrypt achieves this with Hidden Volumes. TrueCrypt allows you to create Hidden Volumes when specifying the creation of Partition Hosted Volumes or when encrypting the operating system. A hidden volume is implemented by wrapping the encrypted volume you want to hide inside another TrueCrypt volume. The volume you want to hide is also moved to the free space area of the outer volume. TrueCrypt makes this easy to achieve through its wizard. Note that both the outer volume and the hidden volume must have different passwords. These passwords should also be significantly different. TrueCrypt hidden volume creation The outer volume can contain some files that you will be able to reveal if forced to give a password. Ideally, these should be files that represent a security concern to you, in order for your deniability to remain plausible. However, after opening the outer volume, other than those files, all your opponent will see is empty space — unknowing to him that that empty space is in fact another TrueCrypt volume that requires another password to decrypt. The empty space on a hard drive or any other storage media is usually represented internally by seemingly random data, especially after doing a disk wipe. This is exactly what an encrypted volume looks like. So you can safely give your password away for the outer volume and convince your opponent there is nothing more to it (admittedly, plausible deniability is 10% technological trick and 90% good acting). However, the plausible deniability of TrueCrypt has been under the close scrutiny of security analysts. Some deficiencies have been pointed out. The most glaring one may be the fact that TrueCrypt volumes invariably pass two tests that attempt to introduce the concept of Probable Cause against that of Plausible Deniability. Namely, TrueCrypt volumes sizes are divisible by 512 and they pass a Chi-Square randomness test. In the presence of this, there may be some reasonable suspicion that the empty space is in fact a hidden volume (or for any purpose, encrypted data). More so if we consider TrueCrypt hidden volumes are a known feature of the program. You can always argue you used a tool to wipe that empty space and that is the reason why it passes those tests. This strengthens the argument for plausible deniability because there are in fact disk wiping tools that specifically do this. But the truth of the matter is that a minimum amount of reasonable doubt should only deter law enforcement officials, not criminals trying to extort information from you. [PAGEBREAK][PAGETITLE=Encryption and Performance][Top Ad] TrueCrypt uses On-The-Fly...

TrueCrypt Primer: Part 1 – What It Is & Why You Should Care

Page 171 –