Yesterday, The homepage for the popular full disk encryption solution, Truecrypt, changed to reflect the following:
WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues
This page exists only to help migrate existing data encrypted by TrueCrypt.
The development of TrueCrypt was ended in 5/2014 after Microsoft terminated support of Windows XP. Windows 8/7/Vista and later offer integrated support for encrypted disks and virtual disk images. Such integrated support is also available on other platforms (click here for more information). You should migrate any data encrypted by TrueCrypt to encrypted disks or virtual disk images supported on your platform.
The page goes on to describe how to configure Bitlocker encryption and remove Truecrypt.
The message is very odd, as there were no indications of the project ending. Truecrypt does very specific things. It is not the sort of software which requires expansive numbers of new features. It works well with Windows 7, which is a huge part of the market. I have not attempted to use it on Windows 8, but Microsoft’s own page on it indicates that it works fine. My reasons for distrusting the new message, despite the fact that the issuer of that message has access to the correct keys to sign the TC release are:
- There are no details of the security issues with Truecrypt.
Assuming this message is actually from the same people who have been developing Truecrypt, they should have no problem at all clearly describing the nature of the vulnerabilities. They have more ability to do this, once those vulnerabilities are known, than anyone else. The lack of detail makes me suspicious. - The endorsement of Bitlocker flies in the face of the history of the project.
The developers of Truecrypt have shown a consistent (and justified) pattern of paranoia. The sudden endorsement of a closed source security solution is a completely different (and worse) attitude towards security. Among the most suspicious aspects of this is the fact that TC has explicitly avoided dependence on the TPM module due to a lack of trust, yet the “solution” suggested by the homepage currently explicitly endorses using that functionality in moving to Bitlocker. - The new release appears to not actually correct bugs or improve functionality.
7.2 appears to do nothing more than issue warnings and disable encryption. The users of Truecrypt tend to be a savvy lot. They have the skills to decrypt data should that become necessary. Issuing a version with the encryption function disabled is nonsensical.
Slightly less Random Ramblings 