TrueCrypt security audit is good news, so why all the glum faces?

The ongoing audit of the TrueCrypt whole-disk encryption tool used by millions of privacy and security enthusiasts has reached an important milestone—a detailed review of its cryptographic underpinnings that found no backdoors or fatal flaws.

The 21-page Open Cryptographic review published Thursday uncovered four vulnerabilities, the most serious of which involved the use of a Windows programming interface to generate random numbers used by cryptographic keys. While that's a flaw that cryptographers say should be fixed, there's no immediate indication that the bug undermines the core security promise of TrueCrypt. To exploit it and the other bugs, attackers would most likely have to compromise the computer running the crypto program. None of the vulnerabilities appear to allow the leaking of plaintext or secret key material or allow attackers to use malformed inputs to subvert TrueCrypt. The report was produced by researchers from information security consultancy NCC Group.

"The TL;DR is that based on this audit, TrueCrypt appears to be a relatively well-designed piece of crypto software," Matt Green, a Johns Hopkins University professor specializing in cryptography and an audit organizer, wrote in a blog post accompanying Thursday's report. "The NCC audit found no evidence of deliberate backdoors, or any severe design flaws that will make the software insecure in most instances."

"The good news is there weren't any devastating findings, which is great news," Kenn White, a North Carolina-based computer scientist and audit organizer, told Ars. "The mixed news is what happens next with the project."

Where do we go from here?

TrueCrypt has become an indispensable tool that's recommended by Amazon and endorsed by National Security Agency leaker Edward Snowden. Unlike FileVault for Macs and BitLocker for Windows, TrueCrypt works across multiple platforms, including both OS X and Windows but also Linux. That gives people a single program that can strongly encrypt data stored on USB drives that are regularly plugged in to a variety of computers.

The largely anonymous developers of TrueCrypt dropped a bombshell last year when they warned that TrueCrypt should no longer be considered secure. The declaration was made more alarming by the TrueCrypt user license, which largely bars the "forking" of TrueCrypt. If the current source code couldn't be borrowed to create an independent version of the program, developers would have to start from scratch, an undertaking that could take years.

The TrueCrypt audit was already underway when the developers issued their warning last May. Still, it brought new urgency to the audit mission. With little more than the vague and unsubstantiated advisory, millions of TrueCrypt users had little choice than to hope it was overstated and that the security and cryptographic fundamentals of the program were nonetheless sound. And so far, that's the picture suggested by the audit findings.

"The possible attacks or vulnerabilities for any kind of direct memory access or unique key material on the drive is exactly the same as you would have with FileVault or BitLocker," White said. All three can be "circumvented if you have physical access or the protected volume is up and running."

The results of the audit may give some people breathing room. Combined with phase-one audit results that found no evidence of backdoors or malicious code, there are no obvious techniques that allow adversaries to decrypt TrueCrypt-protected data. But the prospects for the program remain disquieting. For one thing, neither phase of the audit has—or even could—categorically determine that TrueCrypt is free of fatal flaws (that's true of audits for other software as well). For another, the growing list of bugs that are less severe but still in need of fixing is growing with no clear, legally viable way for anyone to address.

"The loss of TrueCrypt's developers is keenly felt by a number of people who rely on full disk encryption to protect their data," Green wrote. "With luck, the code will be carried on by others. We're hopeful that this review will provide some additional confidence in the code they're starting with."