Scott Brown Consulting &#187; Encryption

TrueCrypt: Hardware Acceleration

Wikipedia: List of Device Bandwidths

Wikipedia: Disk Drive Performance Characteristics

SSDs and TrueCrypt: Durability and Performance Issues

Intel Product Search: AES-NI

TrueCrypt 7.1 Released

scott — Fri, 02 Sep 2011 00:46:18 +0000

Sparse remarks in the changelog for today’s updated release of the TrueCrypt free open-source disk encryption tool, version 7.1, the first new release in nearly a year. Primarily it looks like they have added support for Mac OS X 10.7 Lion. I venture the usual assessment that this update may safely be viewed as optional for users already running at least TrueCrypt 7.0, the most recent major release, absent those experiencing any specific issues.

7.1

September 1, 2011

New features:

Full compatibility with 64-bit and 32-bit Mac OS X 10.7 Lion

Improvements and bug fixes:

Minor improvements and bug fixes (Windows, Mac OS X, and Linux)

I’ll be upgrading several systems here from version 7.0a and expect zero issues. I’ve been running TrueCrypt since version 6.0a in late 2008, and never experienced a single issue upgrading or at any other time. It’s a rock solid program, though the authors are something of a black hole.

If you don’t already have Full Disk Encryption on your portable laptop or notebook computers, this fresh release presents an excellent opportunity to get serious about data theft prevention and fortify your security posture. I offer full service TrueCrypt Full Disk Encryption installation for those who are most comfortable having an expert consultant perform the procedure using streamlined tools. Contact me for information.

Resources

TrueCrypt 7.0a Released

scott — Tue, 07 Sep 2010 17:48:50 +0000

A minor bugfix update to the TrueCrypt disk encryption tool, version 7.0a, was released yesterday. The release notes cite minor bugfixes only, so this update may be viewed as optional for users already running at least TrueCrypt 7.0, the most recent major release, absent those experiencing any specific issues.

In terms of the impacted segment of users, the release notes call out a workaround for an issue affecting Windows Vista and later operating systems only (but not Windows XP) and only with specific storage controller device drivers present.

7.0a

September 6, 2010

Improvements:

Workaround for a bug in some custom (non-Microsoft) drivers for storage device controllers that caused a system crash when initiating hibernation on TrueCrypt-encrypted operating systems. (Windows 7/Vista/2008/2008R2)

Other minor improvements (Windows, Mac OS X, and Linux)

Bug fixes:

Minor bug fixes (Windows, Mac OS X, and Linux)

I’d make this to be pretty limited in extent, and for a fact it doesn’t impact my installations, all Windows XP systems. But, all the same, I’ve updated three systems here at the lab from version 7.0 without issue.

If you don’t already have Full Disk Encryption on your portable laptop / notebook / netbook computers, this fresh release presents an excellent opportunity to get serious about data theft prevention and fortify your security posture. I offer full service TrueCrypt Full Disk Encryption installation for those who are most comfortable having an expert perform the procedure using streamlined tools. Contact me for information.

Resources

TrueCrypt 7.0 Released, Supports Hardware-Accelerated AES

scott — Wed, 21 Jul 2010 05:50:56 +0000

A major, feature-rich update to the TrueCrypt disk encryption tool hit the wire yesterday, notably adding support for Intel’s on-die AES-NI instruction set in Westmere class processors and newer. The authors claim a juicy 4 to 8 times performance leap for hardware-accelerated AES over a pure software implementation.

AES is the Advanced Encryption Standard, the open, powerful encryption cipher officially sanctioned by the Federal government in 2001 for the encryption of top secret information. It has since become so ubiquitous that, as of this year, chip maker Intel has begun burning the logic underlying AES right on to new chips in hard-wired, transistorized form, allowing encryption and decryption duties to be offloaded from software applications for increased security, reliability and performance.

AES is also the fastest of three ciphers supported by TrueCrypt and the default cipher when creating new volumes. With version 7.0 the TrueCrypt development team has made good on their longstanding promise of a future release that would leverage hardware-accelerated AES capabilities when present.

The new version also sports a variety of other usability, technical, and security improvements, including a number of convenience features involving Favorite Volumes (a feature I seldom use personally), and hardening of Hibernation File encryption under Windows Vista and 7 in the case that Full Disk Encryption is not in force (which is an ill-chosen configuration anyway). And, support for native volume encryption of floppy disks is dropped, presumably since no one has even seen a working floppy disk in years.

As the major version number increment suggests, this update is highly recommended for all users running previous versions. I’ve updated three systems here at the lab from version 6.3a without issue, although sadly, none of the three have new enough CPUs to do hardware-accelerated AES.

7.0

July 19, 2010

      New features:

Hardware-accelerated AES (for more information, see the chapter Hardware Acceleration).

Note: If you want to disable hardware acceleration, select Settings > Performance and disable the option ‘Accelerate AES encryption/decryption by using the AES instructions of the processor‘.

A volume can now be configured to be automatically mounted whenever its host device gets connected to the computer (provided that the correct password and/or keyfiles are supplied). (Windows)

Note: For example, if you have a TrueCrypt container on a USB flash drive and you want to configure TrueCrypt to mount it automatically whenever you insert the USB flash drive into the USB port, follow these steps: 1. Mount the volume. 2. Right-click the mounted volume in the drive list in the main TrueCrypt window and select ‘Add to Favorites‘. 3. The Favorites Organizer window should appear. In it, enable the option ‘Mount selected volume when its host device gets connected‘ and click OK.

Also note that TrueCrypt will not prompt you for a password if you have enabled caching of the pre-boot authentication password (Settings > ‘System Encryption‘) and the volume uses the same password as the system partition/drive. The same applies to cached non-system volume passwords.

Partition/device-hosted volumes can now be created on drives that use a sector size of 4096, 2048, or 1024 bytes (Windows, Linux). Note: Previously only file-hosted volumes were supported on such drives.

Favorite Volumes Organizer (Favorites > ‘Organize Favorite Volumes‘ or ‘Organize System Favorite Volumes‘), which allows you to set various options for each favorite volume. For example, any of them can be mounted upon logon, as read-only or removable medium, can be assigned a special label (which is shown within the user interface instead of the volume path), excluded from hotkey mount, etc. The order in which favorite volumes are displayed in the Favorites Organizer window can be changed and it is the order in which the volumes are mounted (e.g. when Windows starts or by pressing the ‘Mount Favorite Volumes‘ hotkey). For more information, see the chapters Favorite Volumes and System Favorite Volumes.  (Windows)

The Favorites menu now contains a list of your non-system favorite volumes. When you select a volume from the list, you are asked for its password (and/or keyfiles) (unless it is cached) and if it is correct, the volume is mounted. (Windows)

      Security improvements:

In response to our public complaint regarding the missing API for encryption of Windows hibernation files, Microsoft began providing a public API for encryption of hibernation files on Windows Vista and later versions of Windows (for more information, see the section TrueCrypt 5.1a in this version history). Starting with this version 7.0, TrueCrypt uses this API to encrypt hibernation and crash dump files in a safe documented way. (Windows 7/Vista/2008/2008R2)

Note: As Windows XP and Windows 2003 do not provide any API for encryption of hibernation files, TrueCrypt has to modify undocumented components of Windows XP/2003 in order to allow users to encrypt hibernation files. Therefore, TrueCrypt cannot guarantee that Windows XP/2003 hibernation files will always be encrypted. Therefore, if you use Windows XP/2003 and want the hibernation file to be safely encrypted, we strongly recommend that you upgrade to Windows Vista or later and to TrueCrypt 7.0 or later. For more information, see the section Hibernation File.

      Improvements:

Many minor improvements. (Windows, Mac OS X, and Linux)

      Bug fixes:

Minor bug fixes. (Windows, Mac OS X, and Linux)

      Removed features:

TrueCrypt no longer supports device-hosted volumes located on floppy disks. Note: You can still create file-hosted TrueCrypt volumes on floppy disks.

The authors dropped a lot more detail in the release notes this time, which is highly appreciated.

Resources

Wikipedia: Advanced Encryption Standard

Wikipedia: AES Instruction Set

Wikipedia: Intel Westmere Architecture

Intel: Advanced Encryption Standard (AES) Instructions Set

TrueCrypt 6.3a Released

scott — Wed, 25 Nov 2009 03:33:44 +0000

A minor maintenance update to disk encryption tool TrueCrypt was released yesterday. The release notes cite bugfixes only, so this update may be viewed as optional for users already running at least TrueCrypt 6.1a, the last “highly recommended” maintenance update, absent those experiencing any specific issues.

6.3a

November 23, 2009

Improvements and bug fixes:

Minor improvements and bug fixes. (Windows, Mac OS X, and Linux)

Such glaring lack of detail in the release notes leaves upgraders unable to ascertain whether the newest fixes do or do not apply to their installations. I have complained about the lack of transparency before though, so I guess the developers have not dropped by. Are there performance improvements, security fixes, new features, or all of the above? Do they apply only to a specific architecture, or everyone? TrueCrypt: your users need to know these things.

In any event I will perform the upgrade to 6.3a on my affected systems for the sake of keeping current.

Resources

TrueCrypt 6.3 Released

scott — Wed, 21 Oct 2009 21:48:31 +0000

The latest maintenance release of disk encryption tool TrueCrypt made general availability today, adding most notably updated operating system support, including support for Windows 7 and Mac OS X 10.6. The release notes don’t indicate anything terrifically critical, so this release may be viewed as optional for users already running at least TrueCrypt 6.1a, the last “highly recommended” maintenance update. That being said, I’ll be immediately updating all installations.

6.3

October 21, 2009

      New features:

Full support for Windows 7.

Full support for Mac OS X 10.6 Snow Leopard.

The ability to configure selected volumes as ‘system favorite volumes’. This is useful, for example, when you have volumes that need to be mounted before system and application services start and before users start logging on. It is also useful when there are network-shared folders located on a TrueCrypt volume and you need to ensure that the network shares will be restored by the system each time it is restarted. For more information, see the chapter ‘Main Program Window‘, section ‘Program Menu‘, subsection ‘Volumes -> Save Currently Mounted Volumes as Favorite‘ in the documentation. (Windows)

      Improvements and bug fixes:

‘Favorite’ volumes residing within partitions or dynamic volumes will no longer be affected by changes in disk device numbers, which may occur, e.g., when a drive is removed or added. (Windows)

Many other minor improvements and bug fixes.  (Windows, Mac OS X, and Linux)

The release notes always say “Many other minor improvements and bug fixes.” For once I would like to know what exactly the improvements and bugfixes include in detail. If there’s one complaint I have about TrueCrypt it’s lack of transparency from the developers.

The in situ version update procedure is fairly trivial, overwriting the installed version of the application and rewriting an updated boot loader in the case of Full Disk Encryption. The end-to-end drive encryption pass does not have to be run again (a common concern). It is recommended (not enforced, but highly advisable) to burn an updated rescue CD for FDE systems since the boot loader has changed – I always do.

Resources

Applications of TrueCrypt, Part 1: Encrypted CDs

scott — Sat, 25 Jul 2009 17:53:11 +0000

I previously discussed the merits of disk encryption as a countermeasure against the physical theft of portable computers and the leakage of private and confidential records that could ensue. But Full Disk Encryption is just scratching the surface of what can be done; the concept can and should be extended to all types of storage media, including portable media. I am currently using TrueCrypt‘s encrypted file-container volume capabilities to create encrypted CD-R’s and USB memory sticks both as part of my own regular secure backup and data vaulting operations and in the implementation of secure backup and data portability solutions for my customers.

Why encrypt a CD? Well, think of it this way: You take a good deal of trouble to protect the data on your computer from disclosure, using access controls like login passwords, software countermeasures to protect against infection and intrusion, maybe you have even followed my advice and implemented Full Disk Encryption. Suppose, though, that you then burn some important documents (lets say financial, tax, or customer records or the blueprints to a sensitive project) from your carefully protected computer to a plain old data CD. You place it on your desk, or in a spindle in a drawer, or in your car, or in a box to take to the post office. Later, when you’re not looking, a bad guy snatches this CD and makes off with it. Just like that, he has unrestricted access to its contents without ever having to defeat any defenses. This is a wide open security gap.

Encrypted CDs close this gap in an airtight way. They are effective against the risk of general theft from the premises, the risk of interception in transport, the risk of disclosure to an untrusted agent in a bailment situation as when data vaulting, the risk of corporate espionage, jealous lovers, the IRS, you name it. Whoever snags it will be the proud new owner of a nice pile of random data that, unless they have 5,000 years and a supercomputer, is totally opaque to them.

Secure portable storage media may even be required for regulatory compliance in many contexts, as when storing sensitive customer data such as Social Security Numbers, credit card numbers, or health records. Data breaches in military, public, and commercial sectors have increasingly been making headlines. Regulatory authorities in Nevada and Massachusetts just passed laws requiring the mandatory encryption of Social Security numbers, bank account numbers, and credit card numbers when carried on portable storage devices like flash drives, setting a precedent that will likely see legislation nationwide.

How to make an encrypted CD

The gist of the procedure is to create an encrypted file-container volume with TrueCrypt that is just slightly less than the size of the target media. I use a 695MB .tc container filesize for a 700MB CD-R. (You could choose a similar container filesize for a 4.7GB single layer DVD-R or 8.5GB dual layer DVD-R). The extra margin of 5MB is used to add some AutoRun machinery to the CD so that when the finished disk is inserted, Windows shell takes you right into password entry for mounting the encapsulated volume.

1. Create an encrypted file-container volume on disk

Open TrueCrypt and start the Volume Creation Wizard by clicking “Create Volume”
Choose the default “Create an encrypted file container”
Choose the default “Standard TrueCrypt volume”
Specify a scratch path where you have sufficient space to hold the 695MB container file. A scratch partition is ideal for this. Make up a filename of your choice, I usually name it contents.tc or [yyyymmdd].tc. For the purposes of this example let’s name it contents.tc
For Encryption Options the default algorithms are fine unless you care to change them
Enter a volume size of 695MB

Specify a password, pick a good one
The documentation says Windows has problems with NTFS on read-only media, but I’ve never had a problem and always choose NTFS
Move the mouse around to populate the Random Pool, then finally click “Format” to create the container file
Writing of the container file shouldn’t take too long, seconds to a minute depending on your system, then you can exit

2. Mount the file-container volume and copy your content into it

Open the container file you just created, contents.tc, for mounting with TrueCrypt. If you named it with a .tc extension a shell association exists and you can just double-click on it to be taken right into TrueCrypt with it already selected as the volume file.
An available drive letter should already be selected. Click “Mount” and enter your password to mount the encrypted volume as that virtual drive.
You can now open that drive letter and populate it with content, whatever is the target data that will be going on the CD. Remember that the drive has a 695MB capacity.
When done, dismount the volume from TrueCrypt using the “Dismount” button.

3. For a convenient and elegant touch, use TrueCrypt’s Traveler Disk Setup utility to generate some AutoRun machinery that will start automatically when the finished disk is inserted

Start the utility from TrueCrypt > “Tools” menu > “Traveler Disk Setup…”
For “Create traveler disk files at (traveler disk root directory)” box, browse for and locate the scratch path you used in step 1 above, the path where the container file resides
Uncheck “Include TrueCrypt Volume Creation Wizard”, you don’t need it for this use case
Under AutoRun Configuration choose “Auto-mount TrueCrypt volume (specified below)”
For “TrueCrypt volume to mount (relative to traveler disk root)” box, browse for and locate the container file itself
“Open Explorer window for mounted volume” should already be checked

Finally, click “Create” to generate the AutoRun components. Traveler Disk Setup quickly creates a folder named TrueCrypt with a little bit of plumbing and a file named autorun.inf in the target path, then you can close out of the utility

4. Burn the CD

Using CD burning software of your choice (I use Nero, but use whatever you have on your machine) create a new Data CD (ISO) compilation
Place the following files into it: contents.tc, autorun.inf, and the TrueCrypt folder
Notice importantly what is happening: You are burning the container – not its encapsulated contents – and the AutoRun machinery to media
Burn the compilation to blank media, label it, and test it

Upon insertion to a computer with AutoPlay enabled, this CD should now prompt you for the password, mount the encrypted volume automatically to an available drive letter, and open an Explorer window to that drive. And because its runtime components are packaged on the disk, it will work even on a machine that doesn’t have TrueCrypt natively installed.

Many security conscious users (myself included) disable AutoPlay because it poses something of a security risk; in this case, you can still mount contents.tc the long way, using TrueCrypt’s main dialog, you just sacrifice some convenience.

The developers of TrueCrypt have remarked that they plan to add support for Raw CD/DVD volumes in a future release, which ought to further simplify this procedure.

Stay tuned to this space for Part 2: Encrypted USB Memory Sticks, where I plan to share a very useful nested AutoRun technique.

Resources