Computer security: Verify, then trust

ONE of the many outcomes of Edward Snowden’s leaks was to confirm what security researchers had long nervously joked about—that Western intelligence agencies spend a great deal of time and money trying to undermine the cryptographic software that secures computers all over the world (similar suspicions swirl around the Chinese and Russian spy agencies, too). The documents suggest that the spies lean on firms to build “back doors” into their products, infiltrate those companies with their own employees, and work to nobble cryptographic standards.

Jolted, and feeling jilted, cryptographers have begun checking their own tools. Earlier in the month a group of Brazilian mathematicians released a set of new codes for a scrambling system called elliptic-curve cryptography, for use by those worried that officially-recommended ones might be tainted. Now a group of cryptographers is trying to crowdfund a full-scale security audit of a popular piece of software called TrueCrypt, to determine whether it can really be trusted. As of this posting, they had raised about $40,000 across two websites.

TrueCrypt is a disk encryption tool, meaning that it is designed to scramble some or all of a user’s hard drive. If anyone malicious were to obtain the disk—or a copy of it—all they would see would be meaningless gibberish. Only the person who knows the password can turn that gibberish back into meaningful information.

TrueCrypt is slick and easy to use, which makes it popular with everyone from lawyers wishing to protect correspondence with their clients to journalists with sources to guard, as well as dissidents in countries where too much complaining can land you in prison or worse. It is also open-source, meaning that the program’s original code is available for anyone to look at. Unlike its closed-source competitors (Microsoft’s BitLocker, for instance) that means that users don’t have to trust the software’s authors to deliver a product free from bugs or sabotage. They can inspect the code for themselves, and check that it behaves as advertised. Following Mr Snowden’s revelations, some of Babbage’s acquaintances declared smugly that, if everyone would simply switch to open source software, such worries would go away.

Well, maybe. But just because the source code is available for review doesn’t mean that anyone has, in fact, reviewed it. And even if they have looked, that does not guarantee no bugs are present. A serious flaw in the random-number generator in Debian, a version of the open-source Linux operating system, went unspotted and unfixed for almost two years (good random numbers are vital for security). Hunting for security flaws is difficult, pedantic work. Even tiny changes in code—substituting one equals sign for two, say—can have catastrophic consequences.

And most users do not download the original source code it and compile it into a useable program themselves, because that is fiddly and difficult. Most will simply download pre-baked executable files. The professionally paranoid will tell you that there is no reason to assume those executables were made from the version of the source code that’s publically available. For all these reasons, Matthew Green, an academic cryptographer at Johns Hopkins university and one of the people organising the audit, wants to have it done by a company that specialises in such work.

“We hope that we’re going to find nothing more than a few innocuous bugs,” says Kenneth White, a security engineer and research scientist who co-founded the project with Dr Green. If Truecrypt gets a clean bill of health, then its users will be reassured that they’re using the strongest protection available.

But will it? As Dr Green explains on his blog, there are some reasons to wonder. For one, TrueCrypt’s developers are a mystery. “They’re from Eastern Europe, apparently,” says Mr White. But that is as much as anyone knows. For all that having open source code should mean that provenance doesn’t matter, in the real world it does. The developers may have good reasons to want to remain anonymous, perhaps to avoid unwelcome attention from their own governments. But they may prefer anonymity for some other, less pleasant reason.

TrueCrypt itself sometimes behaves in odd ways, too. There are differences between the way the program works on Linux and the way it works on Microsoft’s Windows, a much more popular operating system. In Windows, the program adds long chunks of seemingly random data to the drives it encrypts, chunks that are not present in the Linux version. No-one knows why. “If you want to get really tinfoil-hatted about it,” says Dr Green, “you could point out that this would be a great place to [surreptitiously] hide a copy of the user’s password”.

That said, there is, for now, no really strong reason to assume that TrueCrypt is anything other than what it claims to be. Despite the nagging theoretical doubts, it remains popular, even with security researchers. Bruce Schneier, a cryptographer who has copies of at least some of Mr Snowden’s leaked documents through his work with the Guardian newspaper, uses it to help secure his machine. But in the aftermath of Mr Snowden’s revelations, there is a feeling that it would be prudent to double-check.

Article source:


Powered by Facebook Comments

Leave a Reply

Your email address will not be published. Required fields are marked *