Hi Arno, I would go even a step further. Since we know Truecrypt is popular, and America alone spends $50billion+ annually to get 50,000+ of the worlds smartest people to ensure they have back-door access to as much as possible, I'd go so far as to say that some kind of back door is a certainty. Hiding cunning back doors in source code is one of the most interestingly compelling intellectual tasks you could ever dream to work on. Lots of countries spend lots of money hiring lots of very smart people to do just that... (and, just one example, the source uses /dev/random - the current worlds-most-famous-place for hiding backdoors; yet they didn't care to dive into the kernel code behind that, not that doing so is even possible on closed-source windows platforms...) The very start of the analysis reports that they didn't attempt to build the binary we all use, from the source they examined. That's pretty much as far as you need to read :-( Kind Regards, Chris Drake Friday, May 16, 2014, 9:11:39 PM, you wrote: AW> Hi all, AW> I just want to warn everybody not to place too great stock AW> into these results. I have participated in similar, non-public AW> analyses and they can only ever go so deep. Cleverly hidden or AW> disguised backdoors may easily be overlooked, as resources are AW> constrained and attackers will make sure tool-support fails AW> by running their backdoors against the usual tools to make sure AW> they are not found. The same, incidentally, is done by malware AW> writers that check their malware against current virus scanners AW> before deploying them. AW> What you get with the report is a code-quality assessement which AW> is realistic under the assumption that the implementer was AW> non-malicious. That in itself has value, but it is a different AW> kind of statement than people may assume when looking at the AW> report. AW> So what do do if you want to be sure security software you AW> use has no backdoors? By now I am convinced that the only AW> cost-effective way is to have highly competent and careful AW> people you trust implement it for you. Sure, that is expensive, AW> but there are good reasons to believe that an analysis that AW> has a good chance of finding most or all backdoors is a lot AW> more effort and in addition requires a higher level of skill, AW> making it orders of magnitide more expensive. AW> The following quote is even more true for security aspects: AW> "Debugging is twice as hard as writing the code in the first place. AW> Therefore, if you write the code as cleverly as possible, you are, AW> by definition, not smart enough to debug it." - Brian W. Kernighan AW> The only way to get the simplicity you need to be sure there AW> are no backdoors is to enforce it by writing it yourself. AW> Yes, I know that is far from ideal but it is how the AW> situation presents itself to me. AW> Arno AW> On Fri, May 16, 2014 at 07:02:57 CEST, Heinz Diehl wrote: >> Hi, >> >> because cryptsetup is supporting truecrypt, I thought this one could >> be of interest: >> >> http://tinyurl.com/n8z4tcu >> >> _______________________________________________ >> dm-crypt mailing list >> dm-crypt@xxxxxxxx >> http://www.saout.de/mailman/listinfo/dm-crypt _______________________________________________ dm-crypt mailing list dm-crypt@xxxxxxxx http://www.saout.de/mailman/listinfo/dm-crypt
