From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from v6.tansi.org (ns.km31936-01.keymachine.de [87.118.116.4]) by mail.saout.de (Postfix) with ESMTP for ; Fri, 16 May 2014 13:11:40 +0200 (CEST) Received: from gatewagner.dyndns.org (77-57-44-24.dclient.hispeed.ch [77.57.44.24]) by v6.tansi.org (Postfix) with ESMTPA id E270420DC1EA for ; Fri, 16 May 2014 13:11:39 +0200 (CEST) Date: Fri, 16 May 2014 13:11:39 +0200 From: Arno Wagner Message-ID: <20140516111139.GC31000@tansi.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Subject: Re: [dm-crypt] Truecrypt audit List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: dm-crypt@saout.de Hi all, I just want to warn everybody not to place too great stock into these results. I have participated in similar, non-public analyses and they can only ever go so deep. Cleverly hidden or disguised backdoors may easily be overlooked, as resources are constrained and attackers will make sure tool-support fails by running their backdoors against the usual tools to make sure they are not found. The same, incidentally, is done by malware writers that check their malware against current virus scanners before deploying them. What you get with the report is a code-quality assessement which is realistic under the assumption that the implementer was non-malicious. That in itself has value, but it is a different kind of statement than people may assume when looking at the report. So what do do if you want to be sure security software you use has no backdoors? By now I am convinced that the only cost-effective way is to have highly competent and careful people you trust implement it for you. Sure, that is expensive, but there are good reasons to believe that an analysis that has a good chance of finding most or all backdoors is a lot more effort and in addition requires a higher level of skill, making it orders of magnitide more expensive. The following quote is even more true for security aspects: "Debugging is twice as hard as writing the code in the first place. Therefore, if you write the code as cleverly as possible, you are, by definition, not smart enough to debug it." - Brian W. Kernighan The only way to get the simplicity you need to be sure there are no backdoors is to enforce it by writing it yourself. Yes, I know that is far from ideal but it is how the situation presents itself to me. Arno On Fri, May 16, 2014 at 07:02:57 CEST, Heinz Diehl wrote: > Hi, > > because cryptsetup is supporting truecrypt, I thought this one could > be of interest: > > http://tinyurl.com/n8z4tcu > > _______________________________________________ > dm-crypt mailing list > dm-crypt@saout.de > http://www.saout.de/mailman/listinfo/dm-crypt -- Arno Wagner, Dr. sc. techn., Dipl. Inform., Email: arno@wagner.name GnuPG: ID: CB5D9718 FP: 12D6 C03B 1B30 33BB 13CF B774 E35C 5FA1 CB5D 9718 ---- A good decision is based on knowledge and not on numbers. - Plato