bk99.de entertain the web since 1997

bk99.de
KrebsOnSecurity · CryptographyCurated

The mysterious end of TrueCrypt

Summary

At the end of May 2014 the anonymous developers of TrueCrypt replaced the project page with a warning that the program was not secure and instructions for switching to Microsoft’s BitLocker. Brian Krebs reported on 29 May that the most recently published version was signed with the same key as earlier versions, so the message was probably genuine. The end came in the middle of a donation-funded security audit and left many users at a loss.

What happened

truecrypt.org suddenly redirected to the SourceForge page, which now only warned: “Using TrueCrypt is not secure as it may contain unfixed security issues”. Development had been ended in May 2014 after Microsoft terminated support for Windows XP; Windows came with its own encryption. A final version could only decrypt existing containers.

Doubts about a hack were dispelled by unchanged hosting and DNS records and the same signature as in January 2014. Cryptographer Matthew Green, co-initiator of an audit for which more than 70,000 dollars had been donated, considered the message genuine. iSEC Partners had already completed the first part of the audit, the review of the bootloader.

Ideas

  • Security software from anonymous developers carries a dependency risk.
  • A signature helps tell genuine messages from fakes.
  • Unclear licences make it harder for others to carry on.
  • An audit checks code, not the project’s future.

Insights

  • The uncertainty about the reasons fuelled speculation about government pressure; none of it was proven. The second phase of the audit found no backdoor in 2015.
  • The software was continued as the fork VeraCrypt, which fixed weaknesses and is still maintained today.

Facts

  • Krebs reported on 29 May 2014 on the end of TrueCrypt.
  • The last version was signed with the same key as the version from January 2014.
  • According to Matthew Green, more than 70,000 dollars in donations were raised for the audit.

References

Remarks

  • The original TrueCrypt page at SourceForge is blocked for scripts and excluded from the Web Archive; that is why the KrebsOnSecurity report serves as the original here.

Recommendations

  • Choose encryption tools with active maintenance and a clear licence, LUKS on Linux, otherwise for example VeraCrypt.
  • Move old TrueCrypt containers to a maintained format.

Read the original article

Search the Web Archive

Let’s Encrypt · 2026

Post-quantum certificates with Merkle trees

Andrew Gabbitas describes how Let’s Encrypt wants to enable post-quantum authentication with Merkle Tree Certificates without slowing down TLS connections with large individual signatures. An ML-DSA-44 signature is about 2,420 bytes.

RFC · 2026

RFC 9958: Post-quantum cryptography for practitioners

RFC 9958 explains to engineers the properties, transition risks and deployment patterns of post-quantum cryptography. Cryptographic migration starts long before quantum attacks are practically available.