Hi all, I just want to warn everybody not to place too great stock into these results. I have participated in similar, non-public analyses and they can only ever go so deep. Cleverly hidden or disguised backdoors may easily be overlooked, as resources are constrained and attackers will make sure tool-support fails by running their backdoors against the usual tools to make sure they are not found. The same, incidentally, is done by malware writers that check their malware against current virus scanners before deploying them. What you get with the report is a code-quality assessement which is realistic under the assumption that the implementer was non-malicious. That in itself has value, but it is a different kind of statement than people may assume when looking at the report. So what do do if you want to be sure security software you use has no backdoors? By now I am convinced that the only cost-effective way is to have highly competent and careful people you trust implement it for you. Sure, that is expensive, but there are good reasons to believe that an analysis that has a good chance of finding most or all backdoors is a lot more effort and in addition requires a higher level of skill, making it orders of magnitide more expensive. The following quote is even more true for security aspects: "Debugging is twice as hard as writing the code in the first place. Therefore, if you write the code as cleverly as possible, you are, by definition, not smart enough to debug it." - Brian W. Kernighan The only way to get the simplicity you need to be sure there are no backdoors is to enforce it by writing it yourself. Yes, I know that is far from ideal but it is how the situation presents itself to me. Arno On Fri, May 16, 2014 at 07:02:57 CEST, Heinz Diehl wrote: > Hi, > > because cryptsetup is supporting truecrypt, I thought this one could > be of interest: > > http://tinyurl.com/n8z4tcu > > _______________________________________________ > dm-crypt mailing list > dm-crypt@xxxxxxxx > http://www.saout.de/mailman/listinfo/dm-crypt -- Arno Wagner, Dr. sc. techn., Dipl. Inform., Email: arno@xxxxxxxxxxx GnuPG: ID: CB5D9718 FP: 12D6 C03B 1B30 33BB 13CF B774 E35C 5FA1 CB5D 9718 ---- A good decision is based on knowledge and not on numbers. - Plato _______________________________________________ dm-crypt mailing list dm-crypt@xxxxxxxx http://www.saout.de/mailman/listinfo/dm-crypt
