encription software for Linux and Windows / Alternative for TrueCrypt ?

As it has been announced that Truecrypt is not safe anymore, is there any other encryption software that works with Linux and Windows ?

For linux, there's dm-crypt/luks. You could probably access a dm-crypt encrypted partition in Windows by installing a linux vm with virtualbox and mounting the encrypted partition from within the linux vm. I certainly wouldn't trust any windows encryption software that wasn't open source. Truecrypt was open source and I recall hearing rumors that someone outside the US had picked up the code and was working on a new, updated release of a cross platform encryption application based on the old Truecrypt code base:

http://www.rawstory.com/rs/2014/05/2...tery-shutdown/

Ya, I heard this same. Some swiss guys here: https://truecrypt.ch/
...smells like NSA trap :/

You can also open up your truecrypt partitions with dm-crypt

Nothing wrong with 7.1a

Originally Posted by Habitual Nothing wrong with 7.1a

There is something wrong.

TrueCrypt mount volumes with "suid" option by default.It also allows any user who can unlock a volume to
mount it with whatever mount option they want,with the default being "suid" option among others.

The above means,if you can unlock a TrueCrypt volume on a machine,you can get root shell.

Steps to take to show what i just said

1. download "tc.img" from here[1].Thats a TrueCrypt volume.
2. mount it using TrueCrypt
3. browse to the mount point and you will find an executable named "owned".
4. run it with something like "./owned /bin/bash" and you will now have root shell.

Implication:
1. If somebody can use your computer to mount a TrueCrypt volume,that somebody can get root shell in seconds.
2. If there is a linux based public computer with TrueCrypt installed for the public to use to access their TrueCrypt
volumes,then through this trick,any user can get root access on that computer.

[1] https://github.com/mhogomchungu/random_stuff

Originally Posted by mhogomchungu There is something wrong. TrueCrypt mount volumes with "suid" option by default.It also allows any user who can unlock a volume to mount it with whatever mount option they want,with the default being "suid" option among others. The above means,if you can unlock a TrueCrypt volume on a machine,you can get root shell. Steps to take to show what i just said 1. download "tc.img" from here[1].Thats a TrueCrypt volume. 2. mount it using TrueCrypt 3. browse to the mount point and you will find an executable named "owned". 4. run it with something like "./owned /bin/bash" and you will now have root shell. Implication: 1. If somebody can use your computer to mount a TrueCrypt volume,that somebody can get root shell in seconds. 2. If there is a linux based public computer with TrueCrypt installed for the public to use to access their TrueCrypt volumes,then through this trick,any user can get root access on that computer. [1] https://github.com/mhogomchungu/random_stuff

None of that implies anything wrong with TrueCrypt.
If some one has physical access to your host, you have bigger fish to fry.

Originally Posted by Habitual None of that implies anything wrong with TrueCrypt.

Do you not see anything wrong anywhere or you see it but find fault on someone other than TrueCrypt,if yes,who?

Originally Posted by mhogomchungu Do you not see anything wrong anywhere or you see it but find fault on someone other than TrueCrypt,if yes,who?

Originally Posted by mhogomchungu 1. If somebody can use your computer to mount a TrueCrypt volume,that somebody can get root shell in seconds.

This violates the First Rule of Security, deny physical access.
How is that a TC issue?

Originally Posted by Habitual This violates the First Rule of Security, deny physical access. How is that a TC issue?

Physical access is not necessary as the exploit can still be carried out remotely if the
user can login and run TrueCrypt.

The problem is that TrueCrypt can be used as a mean to gain "elevated privileges" and hence
the bug if somebody file one will be classified as a "local privilege escalation bug",like this[1] one.
This will be true especially with the second scenario,a scenario you conveniently did not address.

[1] http://timetobleed.com/a-closer-look...cve-2013-2094/

Originally Posted by mhogomchungu if the user can login and run TrueCrypt.

On multi-seated installations, I will agree it may pose a problem.
But if you're concerned about it, don't use TC or get better "users".

To exploit suid access: This requires a security vulnerability known to the attacker in an suid program like su or sudo. mhogomchungu, you provide a downloadable truecrypt volume containing a program with such a vulnerability deliberately built in, to prove truecrypt 7.1a as unsecure? This is not truecrypt's fault, the program "owned" is unsecure.

To anyone who cares about the "suid" mount option:

- Do not have suid programs in your truecrypt container
- or open the encrypted mapping without mounting, and mount yourself with "-o nosuid"
- if you need programs like su or sudo in the container, always keep them up to date. They run with root rights, but they still check passwords.

Anyway, if you need to encrypt a volume, by far the best way to do it is to use a drive, or a controller-card, that is capable of encrypting the data on the media. The very best forms of cryptography are those that are totally invisible to the end-user.

Originally Posted by cepheus11 To exploit suid access: This requires a security vulnerability known to the attacker in an suid program like su or sudo. mhogomchungu, you provide a downloadable truecrypt volume containing a program with such a vulnerability deliberately built in, to prove truecrypt 7.1a as unsecure? This is not truecrypt's fault, the program "owned" is unsecure. To anyone who cares about the "suid" mount option: - Do not have suid programs in your truecrypt container - or open the encrypted mapping without mounting, and mount yourself with "-o nosuid" - if you need programs like su or sudo in the container, always keep them up to date. They run with root rights, but they still check passwords.

How hard is it to download an executable and run it on a remote system (assuming there's not firewall protections prohibiting it)? I don't buy this assumption that it's the program he wrote that is flawed. I would expect any program that is launched, by a user, is not escalated to higher privileges without prompting for some form of authentication and authorization. The default mount options and truecrypt not restricting what mount options are available to the user are flaws in truecrypt.

I'd say it's a serious bug. If anybody thinks otherwise I have a nice bridge in New York that is for sale; any buyers?

Use veracrypt