Hubbry Logo
TrueCryptTrueCryptMain
Open search
TrueCrypt
Community hub
TrueCrypt
logo
7 pages, 0 posts
0 subscribers
Be the first to start a discussion here.
Be the first to start a discussion here.
Contribute something
TrueCrypt
TrueCrypt
TrueCrypt
View on Wikipedia
from Wikipedia

DeveloperTrueCrypt Foundation
Initial releaseFebruary 2004; 21 years ago (2004-02)[1]
Final release
7.2 / May 28, 2014; 11 years ago (2014-05-28)[2] (Discontinued)
Written inC, C++, Assembly[3]
Operating systemWindows, macOS, Linux,[3] MorphOS[4]
Size3.30 MB
Available in38 languages[5]
List of languages
English, Arabic, Basque, Belarusian, Bulgarian, Burmese, Catalan, Chinese (Simplified), Chinese (Hong Kong), Chinese (Taiwan), Czech, Danish, Dutch, Estonian, Finnish, French, Georgian, German, Greek, Hungarian, Indonesian, Italian, Japanese, Korean, Latvian, Norwegian (Nynorsk), Persian, Polish, Portuguese (Brazil), Russian, Slovak, Slovenian, Spanish, Swedish, Turkish, Ukrainian, Uzbek (Cyrillic), Vietnamese
TypeDisk encryption software
LicenseTrueCrypt License 3.1 (source-available freeware)

TrueCrypt is a discontinued source-available freeware utility used for on-the-fly encryption (OTFE). It can create a virtual encrypted disk within a file, encrypt a partition, or encrypt the whole storage device (pre-boot authentication).

On 28 May 2014, the TrueCrypt website announced that the project was no longer maintained and recommended users find alternative solutions. Though development of TrueCrypt has ceased, an independent audit of TrueCrypt published in March 2015 concluded that no significant flaws were present.[6] Two projects forked from TrueCrypt: VeraCrypt (active) and CipherShed[7] (abandoned).

History

[edit]
See also: TrueCrypt release history

TrueCrypt was initially released as version 1.0 in February 2004, based on E4M (Encryption for the Masses). Several versions and many additional minor releases have been made since then, with the most current version being 7.1a.[1]

E4M and SecurStar dispute

[edit]

Original release of TrueCrypt was made by anonymous developers called "the TrueCrypt Team".[8] Shortly after version 1.0 was released in 2004, the TrueCrypt Team reported receiving email from Wilfried Hafner, manager of SecurStar, a computer security company.[9] According to the TrueCrypt Team, Hafner claimed in the email that the acknowledged author of E4M, developer Paul Le Roux, had stolen the source code from SecurStar as an employee.[9] It was further stated that Le Roux illegally distributed E4M, and authored an illegal license permitting anyone to base derivative work on the code and distribute it freely. Hafner alleges all versions of E4M always belonged only to SecurStar, and Le Roux did not have any right to release it under such a license.[9][10]

This led the TrueCrypt Team to immediately stop developing and distributing TrueCrypt, which they announced online through usenet.[9] TrueCrypt Team member David Tesařík stated that Le Roux informed the team that there was a legal dispute between himself and SecurStar, and that he received legal advisement not to comment on any issues of the case. Tesařík concluded that should the TrueCrypt Team continue distributing TrueCrypt, Le Roux may ultimately be held liable and be forced to pay consequent damages to SecurStar. To continue in good faith, he said, the team would need to verify the validity of the E4M license. However, because of Le Roux's need to remain silent on the matter, he was unable to confirm or deny its legitimacy, keeping TrueCrypt development in limbo.[9][11]

Thereafter, would-be visitors reported trouble accessing the TrueCrypt website, and third-party mirrors appeared online making the source code and installer continually available, outside of official sanction by the TrueCrypt Team.[12][13]

In the FAQ section of its website, SecurStar maintains its claims of ownership over both E4M and Scramdisk, another free encryption program. The company states that with those products, SecurStar "had a long tradition of open source software", but that "competitors had nothing better to do but to steal our source code", causing the company to make its products closed-source, forcing potential customers to place a substantial order and sign a non-disclosure agreement before being allowed to review the code for security.[14]

Le Roux himself has denied developing TrueCrypt in a court hearing in March 2016, in which he also confirmed he had written E4M.[15]

Version 2.0

[edit]

Months later on 7 June 2004, TrueCrypt 2.0 was released.[1] The new version contained a different digital signature from that of the original TrueCrypt Team, with the developers now being referred to as "the TrueCrypt Foundation." The software license was also changed to the open source GNU General Public License (GPL). However, given the wide range of components with differing licenses making up the software, and the contested nature of the legality of the program's release, a few weeks later on 21 June, version 2.1 was released under the original E4M license to avoid potential problems relating to the GPL license.[1][16]

Version 2.1a of the software was released on 1 October 2004 on truecrypt.sourceforge.net sub-domain.[1] By May 2005, the original TrueCrypt website returned and truecrypt.sourceforge.net redirected visitors to truecrypt.org.

End of life announcement

[edit]

On 28 May 2014, the TrueCrypt official website, truecrypt.org, began redirecting visitors to truecrypt.sourceforge.net with a HTTP 301 "Moved Permanently" status, which warned that the software may contain unfixed security issues, and that development of TrueCrypt was ended in May 2014, following Windows XP's end of support. The message noted that more recent versions of Windows have built-in support for disk encryption using BitLocker, and that Linux and OS X had similar built-in solutions, which the message states renders TrueCrypt unnecessary. The page recommends any data encrypted by TrueCrypt be migrated to other encryption setups and offered instructions on moving to BitLocker. The SourceForge project page for the software at sourceforge.net/truecrypt was updated to display the same initial message, and the status was changed to "inactive".[17] The page also announced a new software version, 7.2, which only allows decryption.

Initially, the authenticity of the announcement and new software was questioned.[18][19][20] Multiple theories attempting to explain the reason behind the announcement arose throughout the tech community.[21][3]

Shortly after the end of life announcement of TrueCrypt, Gibson Research Corporation posted an announcement titled "Yes... TrueCrypt is still safe to use" and a Final Release Repository to host the last official non-crippled version 7.1a of TrueCrypt.[3] They no longer host the final release repository as of 2022.

Truecrypt.org has been excluded from the Internet Archive Wayback Machine.[22] The exclusion policy says they will exclude pages at the site owner's request.[23]

Operating systems

[edit]

TrueCrypt supports Windows, OS X, and Linux operating systems.[24] Both 32-bit and 64-bit versions of these operating systems are supported, except for Windows IA-64 (not supported) and Mac OS X 10.6 Snow Leopard (runs as a 32-bit process).[24] The version for Windows 7, Windows Vista, and Windows XP can encrypt the boot partition or entire boot drive.[25]

Independent implementations

[edit]

There is an independent, compatible[26][27] implementation, tcplay, for DragonFly BSD[26] and Linux.[27][28]

The Dm-crypt module included in default Linux kernel supports a TrueCrypt target called "tcw" since Linux version 3.13.[29][30][31]

Encryption scheme

[edit]

Algorithms

[edit]

Individual ciphers supported by TrueCrypt are AES, Serpent, and Twofish. Additionally, five different combinations of cascaded algorithms are available: AES-Twofish, AES-Twofish-Serpent, Serpent-AES, Serpent-Twofish-AES and Twofish-Serpent.[32] The cryptographic hash functions available for use in TrueCrypt are RIPEMD-160, SHA-512, and Whirlpool.[33] Early versions of TrueCrypt until 2007 also supported the block ciphers Blowfish, CAST-128, TDEA and IDEA; but these were deprecated due to having relatively lower 64-bit security and patent licensing issues.[1]

The practical security provided by TrueCrypt depends altogether on the applied encyption algorithms and their different weaknesses. TrueCrypt by itself offers no extra protection against a weak trusted algorithm.

Modes of operation

[edit]

TrueCrypt currently uses the XTS mode of operation.[34] Prior to this, TrueCrypt used LRW mode in versions 4.1 through 4.3a, and CBC mode in versions 4.0 and earlier.[1] XTS mode is thought to be more secure than LRW mode, which in turn is more secure than CBC mode.[35]

Although new volumes can only be created in XTS mode, TrueCrypt is backward compatible with older volumes using LRW mode and CBC mode.[1] Later versions produce a security warning when mounting CBC mode volumes and recommend that they be replaced with new volumes in XTS mode.

Keys

[edit]

The header key and the secondary header key (XTS mode) are generated using PBKDF2 with a 512-bit salt and 1000 or 2000 iterations, depending on the underlying hash function used.[36]

Plausible deniability

[edit]

TrueCrypt supports a concept called plausible deniability,[37] by allowing a single "hidden volume" to be created within another volume.[38] In addition, the Windows versions of TrueCrypt have the ability to create and run a hidden encrypted operating system whose existence may be denied.[39]

The TrueCrypt documentation lists many ways in which TrueCrypt's hidden volume deniability features may be compromised (e.g. by third-party software which may leak information through temporary files, thumbnails, etc., to unencrypted disks) and possible ways to avoid this.[40] In a paper published in 2008 and focused on the then latest version (v5.1a) and its plausible deniability, a team of security researchers led by Bruce Schneier states that Windows Vista, Microsoft Word, Google Desktop, and others store information on unencrypted disks, which might compromise TrueCrypt's plausible deniability. The study suggested the addition of a hidden operating system functionality; this feature was added in TrueCrypt 6.0. When a hidden operating system is running, TrueCrypt also makes local unencrypted filesystems and non-hidden TrueCrypt volumes read-only to prevent data leaks.[39] The security of TrueCrypt's implementation of this feature was not evaluated because the first version of TrueCrypt with this option had only recently been released.[41]

There was a functional evaluation of the deniability of hidden volumes in an earlier version of TrueCrypt by Schneier et al. that found security leaks.[42]

Identifying TrueCrypt volumes

[edit]

When analyzed, TrueCrypt volumes appear to have no header and contain random data.[43] TrueCrypt volumes have sizes that are multiples of 512 due to the block size of the cipher mode[34] and key data is either 512 bytes stored separately in the case of system encryption or two 128 kB headers for non-system containers.[44] Forensics tools may use these properties of file size, apparent lack of a header, and randomness tests to attempt to identify TrueCrypt volumes.[45] Although these features give reason to suspect a file to be a TrueCrypt volume, there are, however, some programs which exist for the purpose of securely erasing files by employing a method of overwriting file contents, and free disk space, with purely random data (i.e. "shred" & "scrub"[46]), thereby creating reasonable doubt to counter pointed accusations declaring a file, made of statistically random data, to be a TrueCrypt file.[37][47]

If a system drive, or a partition on it, has been encrypted with TrueCrypt, then only the data on that partition is deniable. When the TrueCrypt boot loader replaces the normal boot loader, an offline analysis of the drive can positively determine that a TrueCrypt boot loader is present and so lead to the logical inference that a TrueCrypt partition is also present. Even though there are features to obfuscate its purpose (i.e. displaying a BIOS-like message to misdirect an observer such as, "Non-system disk" or "disk error"), these reduce the functionality of the TrueCrypt boot loader and do not hide the content of the TrueCrypt boot loader from offline analysis.[48] Here again, the use of a hidden operating system is the suggested method for retaining deniability.[39]

Performance

[edit]

TrueCrypt supports parallelized[49]: 63  encryption for multi-core systems and, under Microsoft Windows, pipelined read/write operations (a form of asynchronous processing)[49]: 63  to reduce the performance hit of encryption and decryption. On newer processors supporting the AES-NI instruction set, TrueCrypt supports hardware-accelerated AES to further improve performance.[49]: 64  The performance impact of disk encryption is especially noticeable on operations which would normally use direct memory access (DMA), as all data must pass through the CPU for decryption, rather than being copied directly from disk to RAM.

In a test carried out by Tom's Hardware, although TrueCrypt is slower compared to an unencrypted disk, the overhead of real-time encryption was found to be similar regardless of whether mid-range or state-of-the-art hardware is in use, and this impact was "quite acceptable".[50] In another article the performance cost was found to be unnoticeable when working with "popular desktop applications in a reasonable manner", but it was noted that "power users will complain".[51]

Incompatibility with FlexNet Publisher and SafeCast

[edit]
Main article: FlexNet Publisher § Issues with bootloaders

Installing third-party software which uses FlexNet Publisher or SafeCast (which are used for preventing software piracy on products by Adobe such as Adobe Photoshop) can damage the TrueCrypt bootloader on Windows partitions/drives encrypted by TrueCrypt and render the drive unbootable.[52] This is caused by the inappropriate design of FlexNet Publisher writing to the first drive track and overwriting whatever non-Windows bootloader exists there.[53]

Security concerns

[edit]

TrueCrypt is vulnerable to various known attacks which are also present in other disk encryption software releases such as BitLocker. To prevent those, the documentation distributed with TrueCrypt requires users to follow various security precautions.[54] Some of those attacks are detailed below.

Encryption keys stored in memory

[edit]

TrueCrypt stores its keys in RAM; on an ordinary personal computer the DRAM will maintain its contents for several seconds after power is cut (or longer if the temperature is lowered). Even if there is some degradation in the memory contents, various algorithms can intelligently recover the keys. This method, known as a cold boot attack (which would apply in particular to a notebook computer obtained while in power-on, suspended, or screen-locked mode), has been successfully used to attack a file system protected by TrueCrypt.[55]

Physical security

[edit]

TrueCrypt documentation states that TrueCrypt is unable to secure data on a computer if an attacker physically accessed it and TrueCrypt is used on the compromised computer by the user again (this does not apply to a common case of a stolen, lost, or confiscated computer).[56] The attacker having physical access to a computer can, for example, install a hardware/software keylogger, a bus-mastering device capturing memory, or install any other malicious hardware or software, allowing the attacker to capture unencrypted data (including encryption keys and passwords), or to decrypt encrypted data using captured passwords or encryption keys. Therefore, physical security is a basic premise of a secure system. Attacks such as this are often called "evil maid attacks".[57]

Malware

[edit]

TrueCrypt documentation states that TrueCrypt cannot secure data on a computer if it has any kind of malware installed. Malware may log keystrokes, thus exposing passwords to an attacker.[58]

The "Stoned" bootkit

[edit]

The "Stoned" bootkit, an MBR rootkit presented by Austrian software developer Peter Kleissner at the Black Hat Technical Security Conference USA 2009,[59][60] has been shown capable of tampering TrueCrypt's MBR, effectively bypassing TrueCrypt's full volume encryption.[61][62][63][64][65] Potentially every hard disk encryption software is affected by this kind of attack if the encryption software does not rely on hardware-based encryption technologies like TPM, or if the attack is made with administrative privileges while the encrypted operating system is running.[66][67]

Two types of attack scenarios exist in which it is possible to maliciously take advantage of this bootkit: in the first one, the user is required to launch the bootkit with administrative privileges once the PC has already booted into Windows; in the second one, analogously to hardware keyloggers, a malicious person needs physical access to the user's TrueCrypt-encrypted hard disk: in this context this is needed to modify the user's TrueCrypt MBR with that of the Stoned bootkit and then place the hard disk back on the unknowing user's PC, so that when the user boots the PC and types his/her TrueCrypt password on boot, the "Stoned" bootkit intercepts it thereafter because, from that moment on, the Stoned bootkit is loaded before TrueCrypt's MBR in the boot sequence. The first type of attack can be prevented as usual by good security practices, e.g. avoid running non-trusted executables with administrative privileges. The second one can be successfully neutralized by the user if he/she suspects that the encrypted hard disk might have been physically available to someone he/she does not trust, by booting the encrypted operating system with TrueCrypt's Rescue Disk instead of booting it directly from the hard disk. With the rescue disk, the user can restore TrueCrypt's MBR to the hard disk.[68]

Trusted Platform Module

[edit]

The FAQ section of the TrueCrypt website states that the Trusted Platform Module (TPM) cannot be relied upon for security, because if the attacker has physical or administrative access to the computer and you use it afterwards, the computer could have been modified by the attacker e.g. a malicious component—such as a hardware keystroke logger—could have been used to capture the password or other sensitive information. Since the TPM does not prevent an attacker from maliciously modifying the computer, TrueCrypt will not support the TPM.[67]

Security audits

[edit]

In 2013 a graduate student at Concordia University published a detailed online report, in which he states that he has confirmed the integrity of the distributed Windows binaries of version 7.1a.[69]

A crowdfunding campaign attempting to conduct an independent security audit of TrueCrypt was successfully funded in October 2013. A non-profit organization called the Open Crypto Audit Project (OCAP) was formed, calling itself "a community-driven global initiative which grew out of the first comprehensive public audit and cryptanalysis of the widely used encryption software TrueCrypt".[70] The organization established contact with TrueCrypt developers, who welcomed the audit.[71][72] Phase I of the audit was successfully completed on 14 April 2014, finding "no evidence of backdoors or malicious code". Matthew D. Green, one of the auditors, added "I think it's good that we didn't find anything super critical."[73]

One day after TrueCrypt's end of life announcement, OCAP confirmed that the audit would continue as planned, with Phase II expected to begin in June 2014 and wrap up by the end of September.[74][75] The Phase II audit was delayed, but was completed 2 April 2015 by NCC Cryptography Services. This audit "found no evidence of deliberate backdoors, or any severe design flaws that will make the software insecure in most instances".[76][77][78] The French National Agency for the Security of Information Systems (ANSSI) stated that while TrueCrypt 6.0 and 7.1a have previously attained ANSSI certification, migration to an alternate certified product is recommended as a precautionary measure.[79]

According to Gibson Research Corporation, Steven Barnhart wrote to an email address for a TrueCrypt Foundation member he had used in the past and received several replies from "David". According to Barnhart, the main points of the email messages were that the TrueCrypt Foundation was "happy with the audit, it didn't spark anything", and that the reason for the announcement was that "there is no longer interest [in maintaining the project]."[80]

According to a study released 29 September 2015, TrueCrypt includes two vulnerabilities in the driver that TrueCrypt installs on Windows systems allowing an attacker arbitrary code execution and privilege escalation via DLL hijacking.[81] In January 2016, the vulnerability was fixed in VeraCrypt,[82] but it remains unpatched in TrueCrypt's unmaintained installers.

[edit]

Operation Satyagraha

[edit]

In July 2008, several TrueCrypt-secured hard drives were seized from Brazilian banker Daniel Dantas, who was suspected of financial crimes. The Brazilian National Institute of Criminology (INC) tried unsuccessfully for five months to obtain access to his files on the TrueCrypt-protected disks. They enlisted the help of the FBI, who used dictionary attacks against Dantas' disks for over 12 months, but were still unable to decrypt them.[83][84]

United States v. John Doe

[edit]

In 2012 the United States 11th Circuit Court of Appeals ruled that a John Doe TrueCrypt user could not be compelled to decrypt several of his hard drives.[85][86] The court's ruling noted that FBI forensic examiners were unable to get past TrueCrypt's encryption (and therefore were unable to access the data) unless Doe either decrypted the drives or gave the FBI the password, and the court then ruled that Doe's Fifth Amendment right to remain silent legally prevented the Government from making them do so.[87][88]

David Miranda

[edit]
Further information: David Miranda (politician) § Global surveillance activism

On 18 August 2013 David Miranda, partner of journalist Glenn Greenwald, was detained at London's Heathrow Airport by Metropolitan Police while en route to Rio de Janeiro from Berlin. He was carrying with him an external hard drive said to be containing sensitive documents pertaining to the 2013 global surveillance disclosures sparked by Edward Snowden. Contents of the drive were encrypted by TrueCrypt, which authorities said "renders the material extremely difficult to access".[89] Detective Superintendent Caroline Goode stated the hard drive contained around 60 gigabytes of data, "of which only 20 have been accessed to date." She further stated the process to decode the material was complex and "so far only 75 documents have been reconstructed since the property was initially received."[89]

Guardian contributor Naomi Colvin concluded the statements were misleading, stating that it was possible Goode was not even referring to any actual encrypted material, but rather deleted files reconstructed from unencrypted, unallocated space on the hard drive, or even plaintext documents from Miranda's personal effects.[90] Greenwald supported this assessment in an interview with Democracy Now!, mentioning that the UK government filed an affidavit asking the court to allow them to retain possession of Miranda's belongings. The grounds for the request were that they could not break the encryption, and were only able to access 75 of the documents that he was carrying, which Greenwald said "most of which were probably ones related to his school work and personal use".[91]

Lauri Love

[edit]

In October 2013, British–Finnish activist Lauri Love was arrested by the National Crime Agency (NCA) on charges of hacking into a US department or agency computer and one count of conspiring to do the same.[92][93][94] The government confiscated all of his electronics and demanded he provide them with the necessary keys to decrypt the devices. Love refused. On 10 May 2016 a District Judge (Magistrate's Court) rejected a request by the NCA that Love be forced to turn over his encryption keys or passwords to TrueCrypt files on an SD card and hard drives that were among the confiscated property.[95]

James DeSilva

[edit]

In February 2014, an Arizona Department of Real Estate IT department employee, James DeSilva, was arrested on charges of sexual exploitation of a minor through the sharing of explicit images over the Internet. His computer, encrypted with TrueCrypt, was seized, and DeSilva refused to reveal the password. Forensics detectives from the Maricopa County Sheriff's Office were unable to gain access to his stored files.[96]

Druking

[edit]

In the special prosecutor investigation for Druking in South Korea, the special prosecutor decrypted some of the files encrypted by TrueCrypt by guessing the passphrase.[97][98]

The special prosecutor said the hidden volumes were especially difficult to deal with. He decrypted some of encrypted files by trying words and phrases the druking group had used elsewhere as parts of the passphrase in order to make educated guesses.[99][100][101][102]

License and source model

[edit]

TrueCrypt was released as source-available, under the "TrueCrypt License," which is unique to the TrueCrypt software.[103][104] As of version 7.1a (the last full version of the software, released Feb 2012), the TrueCrypt License was version 3.0. It is not part of the panoply of widely used open source licenses. The Free Software Foundation (FSF) states that it is not a free software license.[105]

Discussion of the licensing terms on the Open Source Initiative (OSI)'s license-discuss mailing list in October 2013 suggests that the TrueCrypt License has made progress towards compliance with the Open Source Definition but would not yet pass if proposed for certification as Open Source software.[106][107] According to current OSI president Simon Phipps:

...it is not at all appropriate for [TrueCrypt] to describe itself as "open source". This use of the term "open source" to describe something under a license that's not only unapproved by OSI but known to be subject to issues is unacceptable. ... As OSI director and open source expert Karl Fogel said, "The ideal solution is not to have them remove the words 'open source' from their self-description, but rather for their software to be under an OSI-approved open source license."[106]

As a result of its questionable status with regard to copyright restrictions and other potential legal issues,[108] major Linux distributions do not consider the TrueCrypt License free: TrueCrypt is not included with Debian,[109] Ubuntu,[110] Fedora,[111] or openSUSE.[112]

End of life and license version 3.1

[edit]

28 May 2014 announcement of discontinuation of TrueCrypt also came with a new version 7.2 of the software. Among the many changes to the source code from the previous release were changes to the TrueCrypt License — including removal of specific language that required attribution of TrueCrypt as well as a link to the official website to be included on any derivative products — forming a license version 3.1.[113]

Cryptographer Matthew Green, who had help raise funds for TrueCrypt's audit noted a connection between TrueCrypt's refusal to change the license and their departure-time warning. "They set the whole thing on fire, and now maybe nobody is going to trust it because they'll think there's some big evil vulnerability in the code."[114]

On 16 June 2014, the only alleged TrueCrypt developer still answering email replied to a message by Matthew Green asking for permission to use the TrueCrypt trademark for a fork released under a standard open source license. Permission was denied, which led to the two known forks being named VeraCrypt and CipherShed as well as a re-implementation named tc-play rather than TrueCrypt.[115][116]

Trademarks

[edit]

In 2007 a US trademark for TrueCrypt was registered under the name of Ondrej Tesarik with a company name TrueCrypt Developers Association[117] and a trademark on the "key" logo was registered under the name of David Tesarik with a company name TrueCrypt Developers Association.[118]

In 2009 the company name TrueCrypt Foundation was registered in the US by a person named David Tesarik.[119] The TrueCrypt Foundation non-profit organization last filed tax returns in 2010,[120] and the company was dissolved in 2014.[citation needed]

See also

[edit]

References

[edit]
[edit]
Revisions and contributorsEdit on WikipediaRead on Wikipedia

TrueCrypt

View on Grokipedia
from Grokipedia
TrueCrypt was a discontinued open-source utility for on-the-fly encryption, enabling the creation and mounting of encrypted volumes, partitions, or entire disks as virtual drives that decrypt data transparently during access. Developed anonymously and first released in February 2004 as a successor to the Encryption for the Masses (E4M) project, it supported multiple operating systems including Windows, Linux, and macOS, and incorporated algorithms such as AES, Serpent, and Twofish in cascaded modes. A defining feature was its provision for hidden volumes within outer encrypted containers, facilitating by allowing users to reveal a decoy volume under duress without exposing concealed data. TrueCrypt achieved widespread adoption among privacy advocates and security professionals due to its robust implementation and resistance to known attacks, as validated by independent audits that uncovered no backdoors or critical cryptographic flaws. In May 2014, the anonymous development team unexpectedly halted updates via the official website, issuing a stark advisory that continued use was insecure owing to potential unfixed vulnerabilities and citing the end of Microsoft Windows XP support as a factor, while recommending migration to alternatives like —prompting forks such as to address ongoing needs. This abrupt cessation, absent detailed explanations or evidence of claimed issues, sparked persistent speculation regarding possible external coercion, though post-discontinuation analyses by credible security researchers reaffirmed the software's soundness for legacy versions absent newer threats.

History

Origins and Early Development

TrueCrypt traces its origins to Encryption for the Masses (), an open-source on-the-fly program initiated by in 1997. , which ceased active maintenance after its discontinuation, provided the core codebase and concepts that TrueCrypt expanded upon, including real-time encryption of file containers and volumes. Le Roux later admitted authoring but explicitly denied developing TrueCrypt itself, despite the software's direct lineage from his earlier work. The TrueCrypt project emerged from anonymous developers operating under the pseudonym "TrueCrypt Team," who released version 1.0 on February 2, 2004. These developers maintained strict anonymity, reportedly to shield against potential government coercion or legal vulnerabilities associated with encryption tools, and were presumed to be based outside the United States. Initial development prioritized cross-platform compatibility, with early support for Windows 98, ME, 2000, and XP, alongside features like cascaded encryption algorithms (e.g., AES-Twofish-Serpent) and hidden volumes for plausible deniability. Subsequent minor releases in 2004 and 2005 refined performance and added compatibility, addressing limitations in such as single-OS focus and lack of ongoing updates. The open-source nature under a permissive allowed scrutiny, though the of contributors limited transparency into their motivations or expertise beyond the code's empirical robustness. This era established TrueCrypt as a privacy-focused alternative amid growing concerns over post-9/11. The principal legal conflict surrounding TrueCrypt arose from allegations of code derivation in its early development. TrueCrypt originated as a successor to , an utility authored by , who later became a convicted criminal mastermind. SecurStar , developers of the competing DriveCrypt software, claimed that E4M incorporated proprietary code from their product without permission, and that TrueCrypt inherited this infringement. In mid-2004, shortly after TrueCrypt's initial release on February 19, 2004, SecurStar representative Wolfgang Hafner sent a cease-and-desist letter to the anonymous TrueCrypt team, asserting theft and demanding cessation of distribution. This dispute prompted a several-month halt in TrueCrypt's public availability, as the developers navigated the claims amid their . TrueCrypt Foundation member David Tesařík later confirmed that Le Roux had notified the team of an active legal contention with SecurStar, including received threats, though Le Roux maintained the E4M license's validity. SecurStar suspected Le Roux's direct involvement in TrueCrypt but lacked proof to pursue further action. No public judgment or settlement was documented, and TrueCrypt resumed distribution by late 2004 under version 4.0, with the incident underscoring risks tied to the project's opaque origins and non-standard licensing, which deviated from typical norms by restricting modifications. Post-2014 discontinuation disputes centered on unverified theories rather than litigated matters. The abrupt May 28, 2014, announcement—warning of unfixed vulnerabilities and urging migration to —fueled speculation of U.S. government , such as NSA demands for backdoors, given the software's resistance to compelled disclosure in legal contexts. However, independent audits by the Open Crypto Audit Project, completed in April 2015, identified coding issues like buffer overflows but no intentional backdoors or evidence of external compromise forcing abandonment. Claims of legal pressure remain unsubstantiated, with developers' anonymity preventing direct verification; forks like emerged to address maintenance gaps without resolving origin-related legal ambiguities.

Evolution of Versions and Features

TrueCrypt version 1.0 was released on February 2, 2004, introducing on-the-fly for file containers and partitions primarily on Windows systems including versions 98, ME, 2000, and XP. This initial implementation supported standard encryption algorithms such as AES, Serpent, and , with options for cascaded ciphers, and included basic features like keyfiles and via hidden volumes. Subsequent early releases, such as version 2.1a on October 1, 2004, removed the IDEA algorithm due to patent concerns and established as the official distribution platform, enhancing accessibility while maintaining core capabilities. By version 4.x in 2005, support expanded to , allowing cross-platform volume creation and mounting, which broadened usability beyond Windows-only environments. Version 5.0, released in 2006, added native Mac OS X support and introduced traveler disk setup for portable without installation. Major advancements occurred in version 6.0 in , incorporating parallelized and decryption to leverage multi-core processors for improved on contemporary hardware. Version 6.3 in October 2009 provided full compatibility with and Mac OS X 10.6 , alongside the ability to designate system favorite volumes for streamlined boot-time access. Version 7.0, released July 19, 2010, introduced hardware-accelerated AES , support for drives with sector sizes of 1024, 2048, or 4096 bytes, and a Favorites Organizer for managing multiple volumes; it also enabled hibernation file via on supported systems. Version 7.1 on September 1, 2011, ensured compatibility with both 64-bit and 32-bit Mac OS X 10.7 . The final maintenance release, 7.1a on February 7, 2012, addressed minor bugs across Windows, Mac OS X, and without adding new features. On May 28, 2014, the project announced discontinuation, releasing version 7.2 as a limited Windows-only edition capable solely of decryption and displaying warnings about potential unpatched vulnerabilities, effectively halting further development and feature evolution. This version advised migration to proprietary alternatives like , marking the end of TrueCrypt's iterative enhancements in cross-platform support, performance optimizations, and security mechanisms.

Discontinuation Announcement

On May 28, 2014, visitors to the official TrueCrypt website encountered a prominent warning message stating that "Using TrueCrypt is not secure as it may contain unfixed security issues" and that development of the software had ended. The announcement cited Microsoft's termination of support for in April 2014 as a primary factor, noting that newer Windows versions (7, 8, and Vista) provided built-in encryption via , and urged users to migrate data to such alternatives. Accompanying the message was the release of TrueCrypt version 7.2, which disabled the creation of new encrypted volumes (except for system encryption on /7) and was explicitly intended only for data extraction and transition to other tools, while version 7.1a remained available for legacy use without the security warning. The abrupt nature of the declaration—without prior notice from the anonymous development team—sparked immediate speculation regarding potential external pressures, such as government intervention following disclosures like Edward Snowden's in 2013, though no concrete evidence supported such claims beyond the project's history of legal disputes with entities like the FBI. researchers noted that TrueCrypt had recently passed the first phase of an independent audit by Quarkslab in April 2014, finding no critical flaws, which contrasted sharply with the site's assertion of possible unfixed issues and fueled doubts about the announcement's authenticity or completeness. The website's download section was partially restricted, removing full installer options for new setups and redirecting users toward Microsoft's proprietary solutions, an unusual endorsement for a tool long prized for its open-source independence from commercial ecosystems. Subsequent analysis by experts, including those from the Open Crypto Audit Project, verified the announcement's legitimacy through cryptographic signatures matching prior releases, confirming it originated from the core developers rather than a site compromise. Despite the stated rationale tied to Windows XP's end-of-life, critics highlighted that TrueCrypt supported multiple platforms beyond Windows and had been updated independently of OS support cycles, rendering the explanation incomplete at best. No further communications emerged from the TrueCrypt Foundation, leaving the project's termination as an unresolved enigma in history, with forks like emerging shortly thereafter to address ongoing user needs.

Technical Architecture

Platform Support and Compatibility

TrueCrypt provided native support for Windows, Linux, and Mac OS X operating systems in its final version, 7.1a, released on February 7, 2012, with version 7.2 following in February 2013 primarily for security updates rather than expanded platform features. On Windows, it officially supported 32-bit and 64-bit editions of (Service Pack 2 or later), (Service Pack 1 or later), , , and with Service Pack 4, enabling both file-hosted volumes and full system encryption on compatible versions. For Mac OS X, compatibility extended to versions 10.4 and later, including full support for 10.6 and 10.7 , with 10.8 Mountain Lion also functional via provided binaries, though later releases like Mavericks (10.9) encountered mounting issues due to unsigned kernel extensions requiring manual kernel cache modifications. On Linux, TrueCrypt operated via compilation from source or pre-built binaries on distributions supporting kernel versions 2.6 and above, utilizing FUSE for user-space mounting and kernel modules for block device encryption, without official binaries but with broad compatibility across major distros like and . Encrypted volumes created by TrueCrypt exhibited strong cross-platform compatibility, permitting mounting and access across supported Windows, Mac OS X, and environments without or reformatting, as the software employed standardized containers independent of host s. This interoperability facilitated "traveler" modes, where portable encrypted volumes or bootable disks could be accessed on multiple OSes via included TrueCrypt executables, provided the underlying (e.g., for broadest compatibility) was readable by the target platform. However, system encryption—encrypting the host OS boot partition—was restricted to Windows variants, with no equivalent full-boot support on Mac OS X or due to and kernel integration limitations. Post-discontinuation in May 2014, TrueCrypt's compatibility with newer OS versions diminished without updates; for instance, and later ran existing installations but lacked official validation, while modern macOS versions (post-10.10) and kernels (post-4.x) often required third-party patches or compatibility layers like FreeOTFE for mounting, as kernel signing mandates and deprecated modules hindered native operation. Despite this, core volume formats remain readable by successors like , preserving long-term data accessibility across platforms.

Encryption Algorithms and Modes

TrueCrypt supported three primary symmetric block ciphers: AES-256, Serpent-256, and Twofish-256, each operating with 128-bit blocks. Users could select a single cipher or one of several cascade combinations, where data blocks underwent sequential by multiple ciphers in series to enhance margins, though this increased computational overhead. The available cascades included AES-Twofish, AES-Twofish-Serpent, Serpent-AES, Serpent-Twofish-AES, Twofish-Serpent, and Twofish-Serpent-AES.
AlgorithmDesigner(s)Key Size (bits)Block Size (bits)Mode of Operation
AESJ. Daemen, V. Rijmen256128XTS
SerpentR. Anderson, E. Biham, L.R. Knudsen256128XTS
TwofishB. Schneier et al.256128XTS
AES-Twofish-512128XTS (cascaded)
AES-Twofish-Serpent-768128XTS (cascaded)
Serpent-AES-512128XTS (cascaded)
Serpent-Twofish-AES-768128XTS (cascaded)
Twofish-Serpent-512128XTS (cascaded)
Twofish-Serpent-AES-768128XTS (cascaded)
In cascade modes, each 128-bit block was encrypted sequentially by the constituent ciphers, with each using XTS mode and keys derived from the master key via the selected . This approach aimed to mitigate risks from potential weaknesses in any single , though independent analyses have questioned the necessity of cascades given the robustness of individual ciphers like AES-256, which has withstood extensive since its standardization in 2001. TrueCrypt utilized XTS mode (equivalent to XEX mode with ) as the primary mode of operation for encrypting partitions, drives, and container volumes, introduced in version in 2007. XTS provides sector-specific tweaks derived from logical block addresses, ensuring that identical plaintexts in different sectors encrypt to distinct ciphertexts, while avoiding the malleability issues of earlier modes like CBC. Prior versions employed LRW mode (versions 4.1 through 4.3a) or CBC mode (earlier), both of which were deprecated due to vulnerabilities such as tweak malleability in LRW and watermarking risks in CBC; volumes created with these legacy modes remain compatible but prompt users to upgrade to XTS upon mounting. For XTS implementation, TrueCrypt derived two 256-bit subkeys per cipher—a for encryption and a secondary "tweak key" for generating sector tweaks via AES encryption of the block index—effectively doubling the key material requirements for cascaded algorithms.

Key Derivation and Management

TrueCrypt derives encryption keys from user-supplied passwords or keyfiles using the function as defined in #5 , employing with a pseudorandom function (PRF) such as RIPEMD-160 by default, or alternatively SHA-512 or if selected by the user during volume creation. The process begins with the password, optionally augmented by keyfiles, which are incorporated by hashing each keyfile's contents via SHA-512 and XORing the resulting 64-byte digests sequentially into an expandable buffer initialized with the password bytes, effectively treating the combination as an extended . This combined input, denoted as P, is then processed with alongside a 64-byte random salt S (stored in at the start of the volume header) and a fixed count of 500,000 to produce a 512-bit output: a 256-bit header key for decrypting the volume header and a 256-bit secondary header key for XTS mode operations. The derived header keys enable decryption of the protected portion of the 512-byte volume header (bytes 64–512, following the salt), which contains the randomly generated master keys used for data encryption: a 256-bit primary master key and a 256-bit secondary master key, both employed in XTS-AES (the default mode) to encrypt volume data in 512-byte sectors. During volume mounting, the software reads the salt, reapplies PBKDF2 to the provided P and S to regenerate the header keys, decrypts the header to extract the master keys, and verifies integrity via a stored hash; successful decryption grants access to the data without exposing the master keys to the password derivation process. The master keys remain constant throughout the volume's lifecycle, as they are generated once at creation using the TrueCrypt random number generator and stored solely in encrypted form within the header (and backup header). Key management in TrueCrypt emphasizes separation between user credentials and keys to facilitate changes without re-encrypting the entire . To alter a or keyfiles, the software generates a new salt and derives fresh header keys from the updated credentials, then re-encrypts the existing master keys and header contents with these new keys, preserving the original unchanged. This approach incurs minimal computational overhead compared to regenerating master keys, but requires recreating the volume and if adversarial access to prior headers is suspected, as old salts and derived keys could otherwise enable recovery of the master keys. Keyfiles enhance by distributing credential elements across files, which can be stored separately or generated from non-file sources like algorithms, but they introduce risks if files are compromised, as TrueCrypt does not enforce keyfile integrity checks beyond their hash incorporation. For system , additional key derivation secures the pre-boot environment, deriving keys to protect bootloader-stored master keys similarly.

Plausible Deniability Mechanisms

TrueCrypt implements plausible deniability primarily through hidden volumes and hidden operating systems, allowing users to reveal decoy data under coercion while concealing sensitive information. These features rely on the indistinguishability of encrypted data from random noise, as TrueCrypt volumes lack any detectable signatures or headers until decrypted with the correct password. Consequently, an adversary cannot prove the presence of encrypted content without the passphrase, enabling claims that the data represents securely erased or unused space. Hidden volumes function by embedding a secondary encrypted within the free space of an outer . The outer , accessible via a standard , stores innocuous files to provide a plausible for the encryption's existence. A distinct derives the key for the hidden volume's header, which is stored within the outer volume's and appears as random data when the outer is mounted. Upon mounting the outer , TrueCrypt fills its reported free space with randomized padding to mask the hidden volume's location and prevent forensic detection via analysis or discrepancies. To mitigate risks of overwriting the hidden volume during writes to the outer, users can specify a protection that prompts verification before allowing such operations, or manually avoid the free space region. This design supports steganographic deniability, as the hidden volume's existence cannot be mathematically proven without the , though it assumes the adversary lacks multi-snapshot access to detect changes in free space patterns over time. Hidden operating systems extend this to bootable environments, encrypting a full OS installation within the system partition or drive. After encrypting and installing a decoy outer OS, a hidden OS is created in the same space using a separate password, with both sharing the partition's total size. requires selecting the hidden option and entering its password, which decrypts a distinct header and loader, rendering the outer OS irrelevant during hidden sessions. This setup maintains deniability by allowing revelation of the outer OS, but the unencrypted boot loader on the drive's first track may indicate TrueCrypt usage in system-encrypted setups. File-hosted volumes () inherently lack base-level deniability due to the visible container file, necessitating a hidden volume for protection.

Performance and Practical Use

Benchmarking and Optimization

TrueCrypt included a built-in benchmarking tool accessible via the "Tools" menu, which measured encryption and decryption speeds for supported algorithms (such as AES, Serpent, and ) and hash functions (e.g., RIPEMD-160, SHA-512) using data chunks up to 100 MB, primarily limited by CPU performance rather than storage I/O during tests. Benchmarks typically revealed AES as the fastest algorithm, achieving speeds exceeding 200 MB/s on mid-2000s CPUs like the AMD 4050E without , while slower ciphers like Serpent or lagged significantly due to higher computational demands. Real-world throughput was constrained by storage device speeds, with HDDs rarely exceeding 100-150 MB/s even on capable hardware, and SSDs showing 10-20% write performance degradation under full-disk encryption due to overhead from on-the-fly encryption/decryption. Performance scaled with multi-core CPUs, as TrueCrypt's implementation parallelized operations across available cores, though single-threaded bottlenecks persisted in key derivation and certain modes; tests on FX-8350 processors demonstrated near-linear scaling for AES workloads with larger data chunks. via AES-NI instructions, supported since version 7.0, dramatically improved AES speeds—often to over 1 GB/s raw on 2 GHz cores—reducing CPU utilization to below 50% of a single core for disk-bound tasks and mitigating impacts in virtualized environments or without native support. Without AES-NI, alternatives like software-emulated AES or cascaded ciphers (e.g., AES-Twofish-Serpent) incurred 2-5x slowdowns, making them unsuitable for high-throughput scenarios. Optimization centered on algorithm selection and configuration: users were advised to prioritize AES for speed-critical volumes, enable where available (automatically detected on compatible processors post-2010), and use partition-based containers over file-based ones for reduced overhead in I/O-intensive setups, yielding up to 20-30% faster sustained writes on mechanical drives. Buffer sizes and PIM (Personal Iterations Multiplier) settings in key derivation could be tuned for balance—higher PIM values enhanced security but increased boot times and CPU load during access, with empirical tests showing minimal runtime impact on modern hardware unless PIM exceeded 100,000. System introduced periodic CPU spikes (up to 100% utilization for 10-60 seconds every few minutes), resolvable by disabling unnecessary filesystem features like or optimizing drivers, though these were artifacts of pre-boot rather than core efficiency. Overall, TrueCrypt's C++ codebase emphasized CPU efficiency, outperforming contemporaries like in raw benchmarks on equivalent hardware by leveraging optimized assembly routines for non-accelerated paths.

Known Compatibility Issues

TrueCrypt supported a range of operating systems but with notable limitations on features across platforms. It was compatible with through 7 (32-bit and 64-bit), select server editions, Mac OS X 10.4 Tiger through 10.7 Lion, and distributions using kernel 2.6 or later, though unsupported variants included Windows IA-64 editions and embedded systems. Full system drive required pre-boot and was available only on SP2 or later, excluding Mac OS X and entirely despite volume mounting support on those systems. On and Server 2003, system was restricted to primary partitions and incompatible with extended or logical partitions, as the could not handle the latter without additional steps. Volumes using cascade algorithms (e.g., AES-Twofish-Serpent) created in TrueCrypt versions prior to 5.1 (released December 2008) failed to boot on Windows installations predating XP SP2 due to incompatibilities, requiring users to upgrade software, decrypt the drive, and re-encrypt with a single algorithm like AES or non-cascade modes. Dynamic disks were unsupported for system , as TrueCrypt's design did not accommodate their volume management structure. Third-party software posed additional risks; for example, Acresso /SafeCast, used for license activation in applications like products, could overwrite the TrueCrypt on system-encrypted drives by writing to the first track of the device, rendering the system unbootable until restoration via a TrueCrypt Rescue Disk or deactivation of the conflicting software. The was automatically tuned to the installing OS version to circumvent Windows XP-specific issues, but this led to failures in multi-boot setups or after OS downgrades (e.g., Vista to XP). Windows 2000 lacked integration with the Windows Mount Manager, preventing automatic and compatibility with tools like Disk Defragmenter for mounted volumes. Following discontinuation in May 2014, compatibility with subsequent OS releases diminished. On and 10, the unsigned TrueCrypt kernel driver failed to load under default secure boot and driver signature enforcement policies, requiring users to disable these protections or use compatibility modes, which introduced security risks. TrueCrypt did not support GPT disk partitioning schemes, increasingly standard post-2010, limiting its use on modern UEFI-based systems. On Mac OS X 10.10 Yosemite and later, including Mojave, installation often failed with erroneous requirement errors (e.g., claiming need for 10.4 despite support up to 10.7) or FUSE filesystem dependency conflicts, compounded by deprecated kernel extensions in post-2014 macOS versions. Cross-platform volume sharing worked for file containers and non-system partitions via or but encountered filesystem-specific hurdles, such as exFAT read/write inconsistencies on Mac hardware.

Security Assessment

Identified Vulnerabilities

In September 2015, security researcher James Forshaw identified two critical vulnerabilities in TrueCrypt's Windows kernel driver (version 7.1a), designated CVE-2015-7358 and CVE-2015-7359. CVE-2015-7358 stems from improper validation in the IsDriveLetterAvailable method within Driver/Ntdriver.c, allowing a local unprivileged attacker to access handles to arbitrary running processes and enumerate or manipulate system resources, potentially leading to full administrative control. CVE-2015-7359 involves flawed device object creation and access checks in the same driver, enabling similar local escalation to SYSTEM privileges without requiring prior administrative access. These flaws require local access but could facilitate persistence or on compromised systems, and they remained unpatched due to TrueCrypt's discontinuation. An additional installer , CVE-2016-1281, affects TrueCrypt versions 7.1a and 7.2, exploiting an untrusted search path that permits attackers to load a malicious DLL (via DLL hijacking) during installation, resulting in with elevated privileges. Earlier, TrueCrypt 4.1 exhibited a Linux-specific untrusted search path issue when running with suid privileges, allowing users to execute arbitrary commands and gain access by placing malicious libraries in searched directories. The Open Crypto Audit Project (OCAP) phases 1 and 2 (2014–2015), along with the German Federal Office for Information Security (BSI) verification in November 2015, uncovered numerous implementation flaws through manual code review and static analysis tools like Clang, Cppcheck, and Coverity. High-severity issues included the use of memset() for clearing sensitive data, which compilers could optimize away, risking kernel memory disclosure of encryption keys or passwords (OCAP Finding 4, confirmed high practical threat by BSI). Other notable findings encompassed buffer overreads in the bootloader decompressor (requiring physical access, thus low exploitability), integer overflows in IOCTL handlers potentially leaking information, poor error handling in encryption routines risking data corruption or blue screen of death, and multiple null pointer dereferences or resource leaks. Static tools flagged dozens of input validation errors, such as out-of-bounds array accesses and insecure data handling, though many proved non-exploitable after manual evaluation due to context limits like kernel protections or physical access needs. No or remote code execution vulnerabilities were identified in these audits, with OCAP concluding no of deliberate backdoors or severe flaws compromising core in typical use. However, ancillary issues like weak in the Windows random number generator under failure conditions and unauthenticated volume headers (vulnerable to tampering) heightened risks for specific scenarios, such as virtualized environments or keyfile usage. These findings underscore TrueCrypt's reliance on unmaintained code, amplifying local attack surfaces post-2014 discontinuation.

Independent Audits and Findings

In 2014, the Open Crypto Audit Project (OCAP) commissioned iSEC Partners to conduct Phase 1 of an independent security assessment of TrueCrypt version 7.1a, focusing on the Windows kernel driver, , and filesystem driver. The audit identified several potential vulnerabilities, including buffer overflows and improper error handling in the that could theoretically allow if an attacker had physical access and modified the , but concluded these were not easily exploitable and found no evidence of intentional backdoors or critical design flaws. iSEC recommended mitigations such as improved input validation, which were not implemented in TrueCrypt itself but informed subsequent forks like . Phase 2 of the OCAP audit, performed by in 2014–2015 and covering the full TrueCrypt 7.1a codebase across Windows, macOS, and , confirmed the absence of deliberate backdoors or severe cryptographic weaknesses. The auditors noted 69 minor issues, including outdated dependencies, potential denial-of-service vectors from malformed inputs, and non-critical coding practices like insufficient in some non-security contexts, but emphasized that the core implementation remained robust against known attacks when used as intended. rated the software as "relatively well-designed" for its era, with no findings undermining its resistance to brute-force or side-channel attacks under standard configurations. The German Federal Office for Information Security (BSI) conducted a separate analysis in 2015, incorporating OCAP findings and evaluating TrueCrypt's overall security posture. BSI classified TrueCrypt 7.1a as suitable for protecting sensitive data against unauthorized access, provided users applied strong passphrases and avoided deprecated features like the legacy cascade modes, but warned of risks from unpatched platform-specific vulnerabilities post-discontinuation. Independent researcher James Forshaw identified a Windows-specific elevation-of-privilege flaw in TrueCrypt's installer in 2015, exploitable with local access, which highlighted ongoing maintenance needs but did not affect the encryption engine. These audits collectively affirmed TrueCrypt's cryptographic integrity while underscoring its reliance on user diligence and the limitations of static code analysis for detecting all runtime threats. No audit uncovered evidence supporting claims of government-compromised backdoors, attributing the software's discontinuation to developer fatigue rather than discovered flaws.

Resistance to Attacks and Empirical Evidence

TrueCrypt's encryption algorithms—AES, Serpent, and Twofish, employed in XTS mode—exhibit robust resistance to known cryptanalytic attacks, with implementations verified through extensive testing against reference libraries like and , showing no deviations across millions of test vectors. Independent audits, including the Open Crypto Audit Project (OCAP) Phase 2 report from 2015, identified no deliberate backdoors or severe design flaws that undermine the core cryptographic strength, affirming that the software fulfills its promised confidentiality for data at rest when properly configured and the system is powered off. Empirical evidence from these audits supports unbroken integrity, as static and dynamic analyses revealed no exploitable weaknesses in the cipher operations themselves, with automated tools like , , and yielding primarily false positives for critical issues after manual review. The BSI's security analysis explicitly stated that "the analysis did not identify any evidence that the guaranteed characteristics are not fulfilled in the ," based on and code examination. Real-world deployment over a decade, including by security-conscious users in adversarial environments, produced no documented cases of passphrase-independent decryption via , underscoring practical resilience against theoretical breaks. Limitations persist in non-cryptanalytic vectors: key derivation via uses only 500–2000 iterations for certain modes, falling short of NIST recommendations (e.g., 1 million+), which reduces resistance to offline dictionary or brute-force attacks on weak using GPU-accelerated hardware. Side-channel vulnerabilities, such as cache-timing in the AES bootloader implementation, enable potential key recovery under controlled conditions like virtual machines, though exploitation demands high expertise and repeated access. Volume headers lack , exposing them to manipulation without detection, and the software offers no defense against active threats like or keyloggers on running . These factors do not compromise the cipher's soundness but highlight that security relies heavily on operational discipline, such as passphrase strength and system isolation.

Discontinuation Controversies

Official Explanations and Warnings

On May 28, 2014, the TrueCrypt website abruptly announced the end of development, stating that it ceased in May 2014 following Microsoft's termination of support. The official message attributed the discontinuation to the availability of integrated encryption in newer Windows versions, specifically recommending Microsoft's for Windows 8, 7, and Vista users, which purportedly offers compatibility with TrueCrypt volumes via command-line parameters. The announcement prominently featured a warning: "Using TrueCrypt is not secure as it may contain unfixed security issues." No specific vulnerabilities were detailed in the message, despite the claim of potential issues. Concurrently, version 7.2 was released, but with functionality limited to mounting and decrypting existing volumes created by prior versions; it disabled the creation of new encrypted volumes or system encryption. This version was digitally signed with the established TrueCrypt private key, lending credence to its authenticity from the original developers. The site's updated content urged immediate migration to vendor-supported alternatives like , for macOS, or LUKS for , emphasizing that continued use of TrueCrypt posed risks due to lack of ongoing maintenance. One pseudonymous developer later confirmed to that the project ended due to developer boredom after a decade of work, aligning with the timing but not elaborating on security concerns.

Theories of External Influence

Following the abrupt discontinuation of TrueCrypt on May 28, 2014, various unverified theories emerged positing external governmental influence, particularly from U.S. intelligence agencies like the National Security Agency (NSA), as a factor in the developers' decision to cease operations. These speculations gained traction amid contemporaneous revelations from Edward Snowden about NSA efforts to undermine encryption tools, including documented challenges in cracking TrueCrypt volumes despite extensive attempts. Proponents argued that the software's proven resistance to agency decryption—evidenced by internal NSA assessments classifying it as a "high priority" target yet yielding limited success—may have prompted coercive measures to neutralize it as a threat to surveillance capabilities. One prominent theory suggested that anonymous TrueCrypt developers, potentially identifiable by authorities, received a (NSL) or similar compulsion under the , forcing them either to insert backdoors or abandon the project to avoid compliance. This echoed cases like , where a secure provider shut down in rather than decrypt user data for the FBI. Security expert speculated that if TrueCrypt proved "too effective" against government cracking, officials might have intervened directly, prompting a panicked exit. Similarly, analyses in posited that developers may have detected NSA penetration or anticipated audit failures revealing such compromises, leading to preemptive shutdown to preserve . Another variant held that external pressure stemmed from the ongoing Open Crypto Audit Project (OCAP), where preliminary findings in April 2014 uncovered no major flaws but raised concerns about code complexity and undocumented features, potentially alarming developers if deeper scrutiny risked exposing hidden influences. The timing—mere weeks after the first audit phase—fueled claims of intimidation to halt further examination, especially as TrueCrypt's recommendation of Microsoft BitLocker (perceived as more government-friendly) was seen as anomalous for an open-source project prioritizing independence. However, these theories lack direct evidence, relying on circumstantial patterns like the developers' anonymity (presumed non-U.S. based) and the site's sudden alteration without prior communication. Critics of these speculations, including audit participants, emphasized that no concrete proof of coercion surfaced, attributing the shutdown more plausibly to internal factors like developer burnout or unresolved vulnerabilities rather than substantiated external duress. Snowden-era documents confirmed NSA struggles with TrueCrypt but offered no indication of successful or retaliatory actions against its maintainers. outlets, while reporting the oddities, treated governmental involvement as amplified by post-Snowden , without corroborating leaks or whistleblower accounts. Absent empirical validation, such theories remain speculative, contrasting with the official 's clean initial results and the software's enduring use in high-stakes contexts despite discontinuation.

Evaluation of Speculations Against Evidence

Speculations regarding the TrueCrypt discontinuation often center on external coercion, such as pressure from U.S. intelligence agencies like the NSA, potentially due to the software's resistance to or discovery of undisclosed backdoors. These theories gained traction amid post-Snowden revelations about capabilities, with some positing a Lavabit-style compelled shutdown or developer compromise to avoid introducing deliberate weaknesses. However, independent s conducted after the May 28, 2014, announcement found no evidence of backdoors or intentional malicious code in versions up to 7.1a. The iSEC Partners in April 2014 examined the and generator, identifying issues like potential buffer overflows but confirming "no evidence of backdoors or otherwise intentionally malicious code." Similarly, the 2015 of the full codebase revealed cryptographic weaknesses and obsolete components but no deliberate or NSA-accessible flaws, attributing risks primarily to unpatched legacy code rather than design sabotage. Claims of developer arrests or identities being forcibly revealed lack substantiation, as the pseudonymous team maintained anonymity throughout and no credible reports emerged of legal actions tied to the project. Speculation linking early code contributor —arrested in 2012 for unrelated criminal activities—to the shutdown ignores the timeline, as his involvement predated the 2014 events by over a decade and audits cleared subsequent iterations. While the official explanation citing ’s end-of-support (April 8, 2014) appears implausible given TrueCrypt’s compatibility with Windows 7/8 and cross-platform design, it aligns more plausibly with developer fatigue or funding exhaustion than conspiracy, as no forensic traces of compromise surfaced in code reviews or traffic analysis. noted possible scenarios like hacks or internal disputes but emphasized the absence of confirmatory evidence, cautioning against unsubstantiated paranoia amplified by media coverage. Empirical resistance to attacks further undermines coercion narratives: TrueCrypt volumes withstood real-world decryption attempts in legal cases post-discontinuation, and successor projects like —forked from 7.1a by a presumed original developer in June 2014—retained core algorithms without reported inheritance of flaws. The lack of leaked communications, whistleblower accounts, or anomalous commits precludes causal attribution to external influence, rendering such speculations correlative at best and contradicted by audit-verified integrity. Mainstream reporting often echoed unverified theories amid heightened skepticism, but peer-reviewed cryptographic analyses prioritize the audits' findings over anecdotal dread.

Court-Ordered Decryption Demands

In the , court-ordered decryption demands involving TrueCrypt-encrypted data have primarily arisen in criminal investigations, particularly those related to child exploitation material, where seeks access to seized devices under the Fifth Amendment's privilege against . The compelled act of decrypting data is often treated as , as it implicitly authenticates the existence, possession, and control of the underlying files, potentially incriminating the . Courts have applied the "foregone conclusion" doctrine—derived from Fisher v. United States (1976)—to determine if such compulsion violates the Fifth Amendment; under this exception, decryption may be ordered only if the government independently establishes, with reasonable particularity, the existence and location of the sought materials prior to the compelled act. A landmark case illustrating these tensions is In re Grand Jury Subpoena Duces Tecum Dated March 25, 2011 (11th Circuit, 2012), involving an unnamed defendant ("John Doe") suspected of distributing child pornography. Federal agents seized multiple devices, including five computers and over 150 optical disks encrypted with TrueCrypt, but lacked evidence specifying that incriminating files resided on those particular media or that the defendant controlled access to them. Doe refused a grand jury subpoena to decrypt and produce the contents, leading to a contempt motion. On February 23, 2012, the 11th Circuit vacated the contempt order, ruling that decryption would constitute protected testimony absent a foregone conclusion, as the government had not demonstrated prior knowledge of the files' existence, authenticity, or Doe's possession beyond the mere fact of encryption. This decision underscored TrueCrypt's robust encryption as a barrier to compelled access without independent corroboration, freeing Doe after months of detention. Subsequent cases have refined but not uniformly resolved these issues for TrueCrypt or similar tools. For instance, where prosecutors could show prior viewing of files (e.g., via unencrypted previews or mirrors), courts have compelled decryption as a , though TrueCrypt-specific examples remain limited post-2012 due to the software's discontinuation. No major cases directly involving TrueCrypt decryption demands have been documented, with British legal challenges focusing more on statutory powers under the Regulation of Investigatory Powers Act rather than Fifth Amendment analogs. These rulings highlight ongoing debates: while strong encryption like TrueCrypt's resists brute-force attacks, legal compulsion hinges on evidentiary thresholds rather than technical strength, with defendants sometimes facing sanctions if criteria are met.

Notable Instances of Use and Outcomes

In the Eleventh Circuit's 2012 decision in In re Dated March 25, 2011, a respondent faced a order to produce unencrypted contents from a encrypted with TrueCrypt. The district court had granted immunity but held the respondent in for noncompliance; however, the appeals court vacated the order, ruling that decryption constituted testimonial communication under the Fifth Amendment, as it would implicitly authenticate the existence, possession, and control of potentially incriminating files. The court determined the government's exception did not apply, since agents had not previously viewed the specific encrypted files to establish their nature and existence independently. Similarly, in Commonwealth v. Davis (2019), the Pennsylvania Supreme Court addressed a trial court's order compelling a to decrypt a TrueCrypt volume (version 7.1) containing material. The court reversed, holding that such compulsion violated the Fifth Amendment's privilege against , as the act of providing access testified to the 's knowledge of the contents and their incriminating nature. Without evidence establishing the —that the already knew the files' existence and location—the order was deemed unconstitutional, protecting the from forced disclosure. TrueCrypt's encryption has also featured in law enforcement applications, where its robustness supported secure data handling. A 2010 National Institute of Justice evaluation found that TrueCrypt version 7.0a effectively encrypted evidence for transport in criminal investigations, rendering data inaccessible without the password and enabling agencies to maintain without breaches, provided strong passphrases were used. No unauthorized decryptions were reported in tested scenarios, affirming its utility for protecting sensitive case files during transit. In cases where the doctrine applied—such as when investigators had prior access to decrypted views of files—courts have upheld decryption orders for TrueCrypt volumes. For instance, in scenarios mirroring broader Fifth Amendment precedents, if agents independently confirmed the presence of through other means (e.g., mirrored unencrypted copies), compulsion succeeded without violating protections, though specific TrueCrypt outcomes remain limited by compliance post-ruling to avoid prolonged contempt.

Licensing and Post-Discontinuation Developments

Source Code License and Availability

TrueCrypt was distributed under the TrueCrypt License Version 3.0, a custom license that permits users to view, compile, and use the source code but imposes restrictions on modification, redistribution, and commercial exploitation, rendering it source-available rather than fully open-source software under definitions from bodies like the Open Source Initiative. The license requires that any derivative product incorporating TrueCrypt code must provide its complete source code publicly until distribution ceases, while prohibiting the use of the TrueCrypt name or trademarks without permission and disclaiming all warranties. This structure, described in the license text as a "collective license" combining multiple components, has been criticized for not qualifying as free software by distributions such as Debian and Fedora due to clauses limiting relicensing or broad reuse. Following the project's discontinuation on May 28, 2014, the source code for the final version, 7.1a, remains publicly accessible through mirrors, archival sites, and code repositories, allowing independent compilation and auditing despite the absence of official developer support. Repositories such as those on host the full codebase—written primarily in , , and assembly—under the condition that users agree to the original terms, with downloads exceeding thousands of times annually as of recent repository activity. While the official truecrypt.org domain ceased operations, preserved copies on sites like truecrypt71a.com and academic archives ensure ongoing availability for verification against version 7.1a binaries, though users must verify integrity via checksums to mitigate tampering risks. No updates or new releases have occurred since discontinuation, preserving the code in its 2014 state for historical and forensic purposes.

Forks and Successor Projects

emerged as the primary and successor to TrueCrypt following its discontinuation on May 28, 2014. Developed primarily by French IT security consultant Mounir Idrassi, it is based on TrueCrypt version 7.1a and retains compatibility with TrueCrypt volumes while introducing enhancements such as significantly increased derivation iterations (e.g., 327,661 for system encryption versus TrueCrypt's 1,000) to strengthen resistance against brute-force attacks. underwent a security evaluation by Germany's (BSI) in 2016, which identified some issues but confirmed its overall robustness for on Windows, , and macOS platforms. The project remains actively maintained as of 2025, with ongoing releases addressing vulnerabilities and adding features like support for newer hardware. Other forks include CipherShed, initiated in as a direct continuation of TrueCrypt's codebase to enable collaborative development under a more permissive governance model. However, CipherShed's development stalled, with its last significant activity around 2016 and no major updates since, rendering it effectively dormant despite an independent in that found no backdoors but highlighted some coding concerns. A minor effort, TCnext, was launched by a Swiss team to provide updated binaries of TrueCrypt 7.1a with basic maintenance like compatibility fixes, but it did not evolve into a full-fledged development and focused more on preservation than . These lesser projects underscore the challenges in sustaining TrueCrypt's anonymous development model, with standing out due to its sustained activity and empirical security validations over alternatives.

Intellectual Property Considerations

TrueCrypt's source code is protected by copyright held by its pseudonymous developers, spanning from initial releases in 2004 through the final version 7.1a issued on May 28, 2014. The software operates under the TrueCrypt License (versions 3.0 and 3.1), a custom permissive license that grants users rights to copy, modify, and redistribute the code on an "AS IS" basis without warranties, while explicitly preserving the licensors' intellectual property rights and prohibiting any implied transfer or waiver thereof. This license mandates that derivative products must not incorporate the "TrueCrypt" name or imply affiliation, a clause intended to prevent direct branding reuse and which has shaped post-discontinuation forks by requiring name changes, such as VeraCrypt. The "TrueCrypt" was registered on January 23, 2007 (Registration #3208626) by TrueCrypt Developers Association, LC, a Nevada-based entity associated with Ondrej Tesarik, covering software for data encryption and related services. The reinforces protection by denying permission for its use in derivatives beyond as defined by law, ensuring that while the code itself can be forked and adapted, commercial or distributive exploitation of the brand remains restricted to the original owners. No patents attributable to TrueCrypt's core algorithms or implementation—such as its use of cascade ciphers like AES-Twofish-Serpent—have been identified in public records, aligning with its open-source ethos and anonymous development origins that avoided formal patent filings. Intellectual property considerations have influenced TrueCrypt's legacy, particularly in discouraging unmodified repackaging while permitting code reuse under license constraints; however, the license's non-standard terms have led some distributions, like , to exclude it from repositories due to perceived incompatibilities with definitions, such as those in the Debian Free Software Guidelines. Absent any known litigation or disputes over infringement, the IP framework has primarily served to maintain control over branding amid the software's discontinuation, with successor projects navigating these limits by relicensing under more conventional open terms like Apache 2.0 or GPL variants.

References

  1. https://www.computerhope.com/jargon/t/truecrypt.htm
  2. https://www.truecrypt.org/docs/
  3. https://medium.com/asecuritysite-when-bob-met-alice/the-fall-of-truecrypt-and-rise-of-veracrypt-44f910ed5162
  4. https://forensics.wiki/truecrypt/
  5. https://www.schneier.com/blog/archives/2015/04/truecrypt_secur.html
  6. https://blog.cryptographyengineering.com/2015/04/02/truecrypt-report/
  7. https://www.kaspersky.com/blog/truecrypt-unexplained-disappearance/14957/
  8. https://krebsonsecurity.com/2014/05/true-goodbye-using-truecrypt-is-not-secure/
  9. https://magazine.atavist.com/2016/he-always-had-a-dark-side
  10. https://www.newyorker.com/news/news-desk/the-strange-origins-of-truecrypt-isiss-favored-encryption-tool
  11. https://news.ycombinator.com/item?id=11592619
  12. https://www.darkreading.com/endpoint-security/the-mystery-of-the-truecrypt-encryption-software-shutdown
  13. https://www.askwoody.com/newsletter/the-life-and-untimely-demise-of-truecrypt/
  14. https://groups.google.com/g/alt.security.scramdisk/c/HYa8Wb_4acs
  15. https://www.schneier.com/blog/archives/2014/05/truecrypt_wtf.html
  16. https://www.securityweek.com/truecrypt-not-plagued-backdoors-severe-design-flaws-auditors/
  17. https://risky.biz/WutTruecrypt/
  18. https://alt.security.scramdisk.narkive.com/0PPFbtws/copy-of-truecrypt-user-manual
  19. https://docs.huihoo.com/truecrypt/truecrypt-3.1a-user-guide.pdf
  20. https://www.truecrypt.org/docs/version-history
  21. https://www.truecrypt.org/news
  22. https://www.truecrypt71a.com/documentation/version-history/
  23. https://www.edugeek.net/forums/topic/56340-truecrypt-v70-released/
  24. https://community.chocolatey.org/packages/truecrypt
  25. https://thehackernews.com/2014/05/encryption-tool-truecrypt-shuts-down.html
  26. https://krebsonsecurity.com/2014/05/true-goodbye-using-truecrypt-is-not-secure/comment-page-1/
  27. https://www.techdirt.com/2014/05/28/truecrypt-page-says-its-not-secure-all-development-stopped/
  28. https://www.theguardian.com/technology/2014/may/30/encryption-software-truecrypt-closes-doors
  29. https://www.truecrypt.org/docs/supported-operating-systems
  30. https://www.truecrypt71a.com/documentation/system-encryption/operating-systems-supported-for-system-encryption/
  31. https://andryou.com/truecrypt_orig/docs/supported-operating-systems/
  32. https://discussions.apple.com/thread/5479591
  33. https://www.truecrypt.org/faq
  34. https://superuser.com/questions/615481/how-to-create-a-cross-platform-traveler-disk-with-truecrypt
  35. https://truecrypt.sourceforge.net/
  36. https://www.truecrypt.org/docs/encryption-algorithms
  37. https://www.truecrypt71a.com/documentation/encryption-algorithms/
  38. https://www.truecrypt71a.com/documentation/technical-details/encryption-scheme/
  39. https://www.truecrypt.org/docs/aes
  40. https://www.truecrypt.org/docs/modes-of-operation
  41. https://www.truecrypt.org/docs/header-key-derivation
  42. https://www.truecrypt71a.com/documentation/technical-details/keyfiles/
  43. https://www.truecrypt.org/docs/encryption-scheme
  44. https://security.stackexchange.com/questions/279536/how-does-the-key-distribution-work-in-truecrypt-for-header-encryption-and-decryp
  45. https://stackoverflow.com/questions/6494968/how-does-the-user-inputted-password-unlock-the-master-key-created-by-truecrypt
  46. https://www.truecrypt71a.com/documentation/security-requirements-and-precautions/changing-passwords-and-keyfiles/
  47. https://www.truecrypt.org/docs/keyfiles
  48. https://www.truecrypt71a.com/documentation/plausible-deniability/
  49. http://cyberside.planet.ee/truecrypt/OriginalWebsite/docs/plausible-deniability/
  50. https://www.truecrypt71a.com/documentation/plausible-deniability/hidden-volume/
  51. https://eprint.iacr.org/2021/1547.pdf
  52. https://www.truecrypt71a.com/documentation/plausible-deniability/hidden-operating-system/
  53. https://4sysops.com/archives/bitlocker-vs-truecrypt-performance-benchmark/
  54. https://www.digitalcitizen.life/what-performance-impact-system-encryption-truecrypt/
  55. https://www.overclock.net/threads/truecrypt-benchmark-thread.1401482/
  56. https://security.stackexchange.com/questions/61089/can-truecrypt-encrypt-ssds-without-performance-problems
  57. https://www.truenas.com/community/threads/encryption-performance-benchmarks.12157/
  58. https://www.etcwiki.org/wiki/Truecrypt_speed
  59. https://linagora.com/en/technology/truecrypt
  60. https://www.truecrypt.org/docs/issues-and-limitations
  61. https://www.truecrypt.org/docs/incompatibilities
  62. https://superuser.com/questions/949519/windows-10-upgrade-and-truecrypt
  63. https://forums.anandtech.com/threads/will-truecrypt-work-with-windows-10.2433670/
  64. https://www.reddit.com/r/Windows10/comments/3ccke9/warning_windows_10_insider_installer_truecrypt/
  65. https://apple.stackexchange.com/questions/173879/truecrypt-7-1a-requires-mac-os-x-10-4-or-later-on-yosemite-10-10
  66. https://www.chanhvuong.com/4456/truecrypt-7-1a-on-macos-10-14-mojave/
  67. https://blog.carsoncheng.ca/2016/11/sharing-truecrypt-usb-volume-on-3.html
  68. https://nvd.nist.gov/vuln/detail/CVE-2015-7358
  69. https://thehackernews.com/2015/09/truecrypt-encryption-software.html
  70. https://nvd.nist.gov/vuln/detail/CVE-2016-1281
  71. https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Truecrypt/Truecrypt.pdf
  72. https://opencryptoaudit.org/
  73. https://isecpartners.github.io/news/2014/04/14/iSEC-Completes-Truecrypt-Audit.html
  74. https://kryptera.se/assets/uploads/2014/04/iSec_Final_Open_Crypto_Audit_Project_TrueCrypt_Security_Assessment.pdf
  75. https://opencryptoaudit.org/reports/TrueCrypt_Phase_II_NCC_OCAP_final.pdf
  76. https://arstechnica.com/information-technology/2015/04/truecrypt-security-audit-is-good-news-so-why-all-the-glum-faces/
  77. https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Truecrypt/Truecrypt.pdf?__blob=publicationFile&v=2
  78. https://securityinabox.org/my/blog/truecrypts-security-flaws-what-now/
  79. https://www.pcworld.com/article/444891/truecrypt-source-code-audit-finds-no-critical-flaws-or-intentional-backdoors.html
  80. https://www.securityweek.com/truecrypt-provides-good-data-protection-audit/
  81. https://arstechnica.com/information-technology/2014/05/truecrypt-is-not-secure-official-sourceforge-page-abruptly-warns/
  82. https://www.theregister.com/2014/05/28/truecrypt_hack/
  83. https://www.securityweek.com/truecrypt-not-secure-developers-warn/
  84. https://www.engadget.com/2014-05-30-truecrypt-development-stopped.html
  85. https://www.theverge.com/2014/12/28/7458159/encryption-standards-the-nsa-cant-crack-pgp-tor-otr-snowden
  86. https://www.quora.com/Why-is-TrueCrypt-discontinued
  87. https://www.lawfaremedia.org/article/strange-demise-truecrypt-and-what-it-says-about-cybersecurity
  88. https://www.vice.com/en/article/nsa-paranoia-has-fanned-the-flames-of-truecrypt-conspiracy-theories/
  89. https://arstechnica.com/information-technology/2014/04/truecrypt-audit-finds-no-evidence-of-backdoors-or-malicious-code/
  90. https://thehackernews.com/2015/04/truecrypt-security-audit-services.html
  91. https://www.eff.org/press/releases/appeals-court-upholds-constitutional-right-against-forced-decryption
  92. https://texaslawreview.org/compelled-decryption-and-the-privilege-against-self-incrimination/
  93. https://www.eff.org/cases/us-v-doe-re-grand-jury-subpoena-duces-tecum-dated-march-25-2011
  94. https://www.forbes.com/sites/andygreenberg/2012/02/24/two-cases-lessons-if-cops-dont-know-what-you-encrypted-they-cant-make-you-decrypt-it/
  95. https://www.courthousenews.com/feds-cant-force-man-to-decrypt-computer-data/
  96. https://www.eff.org/deeplinks/2012/03/tale-two-encryption-cases
  97. https://law.justia.com/cases/massachusetts/supreme-court/2014/sjc-11358.html
  98. https://www.eff.org/files/2019/11/20/commonwealth_v._davis_-_majority_opinion.pdf
  99. https://texaslawreview.org/wp-content/uploads/2019/03/Kerr.V97.4.pdf
  100. https://superuser.com/questions/182063/what-is-wrong-with-the-truecrypt-license
  101. https://www.uvm.edu/~ddeutl/TOEC2010/TrueCrypt/License.txt
  102. https://bbs.archlinux.org/viewtopic.php?id=173834
  103. https://github.com/allexpert/TrueCrypt-7.1a
  104. https://github.com/FreeApophis/TrueCrypt
  105. https://www.truecrypt71a.com/documentation/technical-details/source-code/
  106. https://lwn.net/Articles/600701/
  107. https://security.stackexchange.com/questions/58994/are-there-any-reasonable-truecrypt-forks
  108. https://www.esecurityplanet.com/applications/veracrypt-a-worthy-truecrypt-alternative/
  109. https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Veracrypt/Veracrypt.pdf?__blob=publicationFile&v=1
  110. https://news.ycombinator.com/item?id=8190519
  111. https://www.hbarel.com/posts/The-status-of-Truecrypt-2nd-edition.html
  112. https://www.dedoimedo.com/computers/veracrypt.html
  113. https://www.truecrypt.org/docs/license
  114. https://www.truecrypt71a.com/truecrypt-license/
  115. https://news.ycombinator.com/item?id=7892718
  116. https://www.trademarkia.com/truecrypt-78860644
  117. https://www.truecrypt71a.com/documentation/legal-information/
  118. https://lists.freedesktop.org/archives/distributions/2008-October/000276.html
  119. https://fedoraproject.org/wiki/Forbidden_items
  120. https://krebsonsecurity.com/2014/05/true-goodbye-using-truecrypt-is-not-secure/comment-page-3/
Add your contribution
Related Hubs
Contribute something
User Avatar
No comments yet.