TrueCrypt’s dramatic shutdown in May, 2014 left everyone shocked. TrueCrypt was the go-to recommendation for full-disk encryption software, and the developers suddenly said the code was “not secure” and halted development.
We still don’t know exactly why TrueCrypt was shut down — perhaps the developers were being pressured by a government, or perhaps they were simply sick of maintaining it. But here’s what you can use instead.
TrueCrypt 7.1a (Yes, Still)
Yes, TrueCrypt development was officially halted and its official downloads page was taken down. The developers have made statements saying they’re not longer interested in the code, and that third-party developers can’t be trusted to maintain and patch it properly.
However, the Gibson Research Corporation argues TrueCrypt is still safe to use. TrueCrypt 7.1a is the last real version, released in February, 2012 and used by millions of people since then. TrueCrypt’s open-source code is currently undergoing an independent audit — work that started before the abrupt shutdown — and Phase 1 of the audit has been completed without any big problems being found. TrueCrypt is the only software package to ever undergo an independent audit like this one. When it’s finished, any problems found can be patched by the community in a new fork of the TrueCrypt code and TrueCrypt can continue. TrueCrypt’s code is open-source, which means even the original developers don’t have the ability to stop it from continuing. That’s the Gibson Research Corporation’s argument, anyway. Others, such as the non-profit Committee To Protect Journalists, also advise that the TrueCrypt code is still safe to use.
RELATED: How to Secure Sensitive Files on Your PC with VeraCrypt
If you do opt to continue using the standard TrueCrypt code, be sure to get TrueCrypt 7.1a. The official site is offering TrueCrypt 7.2, which disables the ability to create new encrypted volumes — it’s designed to migrate your data away from TrueCrypt to another solution. And, most importantly, be sure to get TrueCrypt 7.1a from a trustworthy location and verify the files haven’t been tampered with. The Open Crypto Audit Project offers their own verified mirror, and the files can also be acquired from the GRC website.
If you go this route, the old advice for using TrueCrypt still applies. Be sure to keep an eye on the results of the TrueCrypt audit. One day, there will likely be consensus around a successor to TrueCrypt. Possibilities might include CipherShed and TCnext, but they aren’t ready yet.
VeraCrypt
VeraCrypt is a fork of TrueCrypt that’s now making the rounds online. VeraCrypt is a fork of TrueCrypt, being based on the TrueCrypt code.
Developer Mounir Idrassi has explained the differences between TrueCrypt and VeraCrypt. In summary, the developers claims he’s fixed “all the serious security issues and weaknesses found so far in the source code” by the Open Crypto Audit Project, as well as various other memory leaks and potential buffer overflows.
Unlike the CipherShed and TCnext projects mentioned above, VeraCrypt has broken compatibility with TrueCrypt’s own volume format. As a result of this change, VeraCrypt can’t open TrueCrypt container files. You’ll have to decrypt your data and re-encrypt it with VeraCrypt.
The VeraCrypt project has increased the iteration count of the PBKDF2 algorithm, adding additional protection against brute-force attacks by making them slower. However, this still won’t help you if you use a weak passphrase to encrypt your volume. This also makes it take longer to boot and decrypt encrypted volumes. If you’d like more details about the project, Idrassi recently spoke to eSecurity Planet about it.
VeraCrypt has now seen its first audit, which led the project to fix a variety of security issues. This project is on the right track.
Your Operating System’s Built-in Encryption
RELATED: 6 Popular Operating Systems Offering Encryption by Default
Current operating systems practically all have built-in encryption — although the encryption build into standard, or Home, editions of Windows is fairly limited. You may want to consider using your operating system’s built-in encryption rather than relying on TrueCrypt. Here’s what your operating system has for you:
Windows 7 Home/Windows 8/Windows 8. 1: Home and “core” versions of Windows 8 and 8. 1 don’t have a built-in full disk encryption feature, which is one of the reasons why TrueCrypt became so popular. Windows 8. 1+ on New Computers: Windows 8. 1 offers a “Device Encryption” feature, but only on new computers that come with Windows 8. 1 and that meet specific requirements. It also forces you to upload a copy of your recovery key to Microsoft’s servers (or your organization’s domain servers), so it’s not the most serious encryption solution. Windows Professional: Professional editions of Windows — Windows 8, and 8. 1 — include BitLocker encryption. It isn’t enabled by default, but you can enable it yourself to get full-disk encryption. Note: Windows 7 Ultimate is required for BitLocker, as the Pro version doesn’t include it. Mac OS X: Macs include FileVault disk encryption. Mac OS X Yosemite offers to automatically enable it when you set a new Mac up, and you can choose to enable it later from the System Preferences dialog if you haven’t. Linux: Linux offers a variety of encryption technologies. Modern Linux distributions often integrate this right into their installers, offering to easily enable full-disk encryption for your new Linux install. For example, modern versions of Ubuntu use LUKS (Linux Unified Key Setup) to encrypt your hard disk.
Mobile devices have their own encryption schemes, too — even Chromebooks have some encryption. Windows is the only platform that still requires going out of your way to protect your data with full-disk encryption.
