No announcement yet.

TrueCrypt 7.0 Released With Hardware-Accelerated AES

  • Filter
  • Time
  • Show
Clear All
new posts

  • #31
    Originally posted by Jimbo View Post
    If you can only see mafia and court bad for u, plausible denial exist and is used, in many aspects. For example, there is a big difference if your boss suspect you steal information and then he goes to your desk:

    - 1, your boss finds stolen data. In your “my documents folder”.
    - 2, your boss finds an encrypted archive.
    - 3, your boss finds an unformatted pen.

    And there are much more situations, simpler, complex, legal, illegal.. not only mafia and courts. I repeat plausible denial exist and it is used.
    Used... sure. Unsuccessfully. If your boss is such a dolt that he can't figure out that your "unformatted" disk is probably encrypted, then you could have hidden the data anywhere withOUT even being encrypted.

    If your boss suspects, he will take action. All three of your examples are executable ONLY by either the COURT or MAFIA, depending on which is selected by your boss. Your boss himself will end up in jail otherwise.

    Your idea of randomness is incorrect as the data increases the randomness is even more random, this is just why “good” chaotic functions are used, there is no pattern to be found. Although in this context we are speaking about formating a partition with random data, even if a pattern is found the important is that the erased data can not be recovered.
    We're talking about the length of the data ***TO BE OBSCURED***, not the length of the randomness. The SOURCE of randomness is just a hose that dumps out an endless supply of random bytes.

    Example: If you write a string of a billion "0"'s to your disk, then the original information can be found by analysing the relative STRENGTH of the zeros. A "weak" zero was previously a "1", a "strong" zero was previously a "0".

    When dealing with TRUE randomness, any particular random BIT that comes out of the random number generator stands a precisely 50% chance of being a ZERO. The probability of getting TWO zeros in a row is 50% x 50% = 25%. The probability of getting THREE zeros in a row is 50% x 50% x 50% = 12.5%. The probability of getting a BILLION zeros in a row is (50%)^1000000000 = very small but ***NON-ZERO***.

    So now we start looking at an infinitely long string of data to obscure. You have an INFINITE number of sequential subsets of the data set of length 1 billion, which means that you have an INFINITE number of chances to achieve said pattern of a billion 0's back to back (by selecting an incremental offset from the starting position of 0-->infinity).... so tell me... what is (INFINITY x (50%)^1000000000)? The answer is, of course INFINITY, which means that you not only are guaranteed to have at least ONE sequence of 0's 1 billion bits long, you are actually guaranteed to have an INFINITE NUMBER of sequences of 0's 1 billion bits long. And laying down a line of 0's a billion bits long doesn't obscure ANYTHING because of the properties of the magnetic medium!

    Note: flash isn't susceptible to the same kind of attacks. I am not aware of any mechanism that can be used to extract "old data" from flash memory aside from data that was simply "erased" (since flash memory tends to be erased by 1'ing out just the first little bit rather than the whole thing).

    I have already pointed that the erase software takes care of writing every sector of the disk, more than 1 time (you can configure it), what kind of erase software should left untouched data on the disk?. You are not saying nothing new with this 0 first then 1.
    And writing every sector more than once doesn't actually guarantee that it *actually changes* anything to something meaningfully different. Nice that you write your random string of all-zeros down onto the disk 10 times... they're still all zeros and the magnetic medium STILL has variations in field strength that can suggest which bits were 1's and which bits were 0's.

    Now obviously, the data you are trying to obscure isn't infinite in length, so at least you aren't going to end up with an infinite amount of readable data.... but that is no guarantee. As unlikely as it is (and it is very very VERY unlikely), it is theoretically POSSIBLE for you to overwrite your entire disk with random data a million times and still have it boot up -- though this, again, would be with the infinite number of monkeys accidentally reproducing the contents of your disk on the last run rather than overwriting it a million times with 0's.... which could also happen. It won't boot up then, but it may still be possible to retrieve the data.

    WHICH IS WHY RANDOM DATA is not a valid choice when you are attempting to obscure data. ALL data destruction programs worth anything will repeatedly overwrite the disk using NON-RANDOM PATTERNS, i.e. 0x00, 0xFF, 0xCC, 0x33, 0xAA, 0x55. Look at those in binary -- you'll see that writing this kind of data does a lot of bit-flipping. THAT is what kills data.

    yeah wireless 802.11 is so untraceable and so secure. I can even imagine something more secure, good point!
    802.11 is simply the network. What you run OVER the network determines how secure your information is. I.e., does the vulnerability of 802.11 encryption make it dangerous to punch your credit card number into a secure website? The answer is NO because the traffic is encrypted between your browser and the server. Someone may listen in and capture the transaction, but the data is useless to them because it is encrypted. And with the option to change your mac address, the only thing that could really link you up would be signal triangulation -- but you'd see the black helicopters and black vans long before they got in close enough to pinpoint the endpoints of the signals to that kind of accuracy.

    In other words, NOTHING is 100%. Flash is probably better than magnetic, as long as you ACTUALLY overwrite the entire thing when you want it erased rather than just "erasing" it. Plausible deniability is ALMOST TOTALLY WORTHLESS. You DO have the right to have encrypted private data... at least you do in north america -- maybe not in some other places. ONLY the court (under certain circumstances) or mafia (if they feel like it) can take that right away from you, and plausible deniability doesn't work on them. Your boss can't tell you not to have private personal encrypted information. He may not like it, but if asked, the encrypted data is your credit card and bank account numbers, and he has no legal right to demand that you show it to him. If there is reason to suspect you of some kind of illegal activity, then it is up to the COURT to order the information out of you. If you pretend that you DON'T have encrypted data when you DO, then people will be SUSPICIOUS of you. In other words... why would you deny the existence of an encrypted file containing your credit card and bank account numbers? It doesn't make sense.

    YES, you have encrypted data. It is {enter some description of reasonable personal information here}.

    Otherwise you end up with the problem of suspicion:
    Me: "I think you have encrypted data. It doesn't make sense that you have a disk with randomness on it -- you're using truecrypt."
    You: "No I don't."
    Me: "Yes you do, here's the truecrypt binary on your computer. What is the data."
    You: "There is none, quit looking at me like that."
    Me (loud): "HEY BOSS! This guy (you) is hiding encrypted data -- he may be stealing trade secrets."

    Me: "That's an encrypted file."
    You: "I keep my credit card and bank account numbers in there so I don't forget them and so nobody can steal them if I accidentally drop the disk somewhere."
    Me: "Ok makes sense, carry on."


    • #32
      There are many situations were you don't need to face experts security plp, you only require to hide your data, and hide you have hidden data. Even when you face experts the possibility to argue between a random formated partition and an encrypted one is an advantage.

      Erase software is aware of the situation you described, it writes every sector once than more time, you can set what pastern to write, you can set how many times... So you can force that 1 million of 0s are not written. You can force first all 0s , then all 1s then 01, what ever you want

      About recovering magnetic state before formating, ok the problem exist, solutions: 1) you can use a new disk , 2) you can use a previous encrypted data. Both solves the problems, but we are speaking about plausible deniability about current data on the disk, encrypted vs random formated. We don't care about previous data. This topic has more sense on other thread.

      About 802.11, you are so, so, wrong. Under strong security environment 802.11 is inviable, broadcast is inviable. All WIFI headers are low protected and they contain critical information about your network (macs, IPs, discovery protocols, etc), some control IP headers or 802.11 headers are low encrypted too and they contain critical information about your network. the IP data fields that contain data about the target encrypted partition are encrypted, but they are broadcast so brute force attacks could take place at peace, you let the attacker to sniff your packets day and night. You never will see a really critical security environment using wifi.


      • #33
        Once the attacker has sufficient information about your network he can begin to direct attack to enter a system to take control. If he access the computer that has mounted the encrypted disk TA DA!!! he doesn't even need to break the encryption because the disk is already mounted. There are a lot of literature about 802.11 risks.


        • #34
          YES, you have encrypted data. It is {enter some description of reasonable personal information here

          Exactly, especially for courts, and especially if you hide really incriminating things encrypted and with stenography inside of a home movie or something like that.

          For the courts to order discovery the plaintiff needs to prove relevance. How do you prove the relevance of seemingly random data? (Even then, the I forgot of I don't recall line may be used) They would need more evidence than just finding a partition that is likely encrypted In criminal proceedings there are may not be any specific facts ordered to be revealed though discovery.

          It's just the rubber hoses that you have to worry about. For that you might mail a dvd seperate from your travels, hide an SD card in a hollow coin or shoe, and only working on data on know secure systems booted from ROM so no temp data is leftover.