安全与密码学2014opencryptoaudit.org
TrueCrypt 安全评估报告
TrueCrypt Security Assessment
进阶 · 约 80 分钟读完前置知识：磁盘加密基础、口令认证与 PBKDF2、软件安全审计
导读
这是 iSec 为 Open Crypto Audit Project 完成的 TrueCrypt 安全评估报告，审查 TrueCrypt 的实现安全并列出若干漏洞与设计弱点。评论特别关注其 PBKDF2 密钥派生迭代次数过低、口令易被暴力破解，以及审计范围明确排除了密码学分析、RNG、算法实现等核心部分。
HN 关注点：广泛使用的加密工具是否可靠、审计结论的边界在哪里，以及低迭代次数对真实口令安全的影响。
后来怎么样
该审计未发现 TrueCrypt 存在后门，但揭示了若干实现与口令派生弱点；它强化了 TrueCrypt 停更后的迁移需求，并成为开源加密软件公开审计的先例之一。
HN 评论精选
这几条评论里：支持 1 补充 3
支持TrueCrypt 的 PBKDF2 迭代次数过低，会显著削弱口令抵抗暴力破解的能力。
TrueCrypt 的 PBKDF2 密钥派生迭代次数按哈希函数和用例为 1000 或 2000。两种情况都太低，即使中等复杂度的密码也无法抵御口令猜测攻击。在 TrueCrypt 被补丁为使用 scrypt 之前，卷密码要多长才超出破解能力？评论还引用 scrypt 论文的估算：PBKDF2 迭代 86,000、密码长度 40 时破解成本约 20 万美元；TrueCrypt 的 1000–2000 次显得极低，而且还没算之后 12 年的硬件进步。
sigil查看英文原文
The iteration count used by TrueCrypt [in its PBKDF2 key derivation] is either 1000 or 2000, depending on the hash function and use case. In both cases, this iteration count is too small to prevent password guessing attacks for even moderately complex passwords. Until TrueCrypt gets patched to use scrypt for key derivation, roughly how long should a volume password be to put it out of reach? Edit: There's a table in the scrypt paper from 2002 [1] that estimates the cost of various brute force attacks. Back then, a PBKDF2 iteration count of 86,000 and a password of length 40 would cost $200K to crack. TrueCrypt's choice of 1000-2000 iterations look staggeringly low in comparison. And that's not even accounting for hardware advances in the last 12 years. [1] page 14, http://www.tarsnap.com/scrypt/scrypt.pdf
补充建议审计 BSD 许可且兼容 TrueCrypt 的替代实现 tcplay。
我希望也有人审计 tcplay，这是 BSD 许可、完全兼容 TrueCrypt 的系统。考虑到这里评论多次提到的许可证问题，我更愿意用它。
616c查看英文原文
I wish someone would also audit tcplay [1], the BSD-license system with full TrueCrypt compatibility. I would much rather use that, if at least for the license concerns repeated many times in the comments here. [1] https://github.com/bwalex/tc-play
补充审计范围不包含 RNG、算法实现等核心密码学分析，结论有明确边界。
评估明确排除了以下领域……密码学分析，包括 RNG 分析、算法实现、安全令牌、keyfile 派生。
floatboth查看英文原文
"The assessment explicitly excluded the following areas... Cryptographic Analysis, including, RNG analysis, Algorithm implementation, Security tokens, Keyfile derivation"
补充呼吁操作系统提供可隐藏、可否认的加密账户，以应对边检强制索要密码。
我希望笔记本和移动设备能有功能，防止随意或滥用的边境检查侵犯隐私：能隐藏“存在一个加密账户”这一事实。比如过英国边境时，他们可随意检查你的设备；若看到你有密码保护的加密账户并要求密码，你拒绝就可能被捕。若他们只看到一个“正常”账户，检查后就会放行；你甚至可以给这个正常账户也设密码并交出密码。实现上只需开机时从主屏幕隐藏该账户，且只能在启动 OS 前的菜单重新启用，不能太容易访问。我不认为微软会做；苹果若有足够多人要求或许会，但目前大概不会；Google 对 Android/Chrome OS 大概也不会。但若 Linux 和 Cyanogen 等定制 Android ROM 提供该功能会很好。
higherpurpose查看英文原文
A feature I'd like to see on both our laptops and mobile devices to protect their privacy from random and abusive border searches: being able to hide the fact that you have an encrypted account. Use case: Say you pass the UK border, and they can willy nilly decide to check your laptop or mobile phone. But you have an account that is password protected and encrypted, and they see that, and ask you for your password. You say no - and you get arrested for it. If they couldn't see you have that password protected account, and all they could see is a "normal" (clean of sensitive stuff) account, then they'd just check that and move on. Or you could even password protect that, too, and give them the password to it, and they'd be none the wiser. All you'd need is to be able to hide that account from the main screen when you turn on the laptop or mobile device, and you should only be able to re-enable it from a menu prior to booting into the OS. It shouldn't be easily accessible either, otherwise it defeats the point. I don't see Microsoft doing something like this - ever. Apple might if enough people asked for it, but I'd incline to say they wouldn't for now. Google probably won't do it either for Android or Chrome OS, since they probably see no benefit to it. But it would be nice if that feature at least came to Linux and some custom Android ROMs like Cyanogen.
相关资源
从这篇论文所有 HN 讨论帖的全部评论里整理出来的链接。
历次讨论
- 2014Hacker News 讨论帖206 分 · 96 评
同领域还值得读
如何入侵一台已关机的电脑：在 Intel ME 中运行未签名代码
How to hack a turned-off computer, or running unsigned code in Intel ME
这篇 Black Hat 2017 白皮书讨论 Intel Management Engine（ME）的安全问题：如何在 ME 中运行未签名代码，以及攻破处于关机状态的电脑的相关…
安全与密码学2017 · 543 分 · 107 评专业 · 约 40 分钟编辑精选比特币：一种点对点的电子现金系统（2008）
Bitcoin: A Peer-to-Peer Electronic Cash System (2008)
中本聪 2008 年发表的比特币白皮书，提出了无需可信第三方的点对点电子现金系统。
安全与密码学2017 · 536 分 · 394 评入门 · 约 45 分钟编辑精选GPRS 加密算法 GEA-1 的密码分析表明存在故意弱点
Cryptanalysis of GPRS Encryption Algorithms GEA-1 suggest intentional weakness
首次公开了对 GPRS 加密算法 GEA-1 和 GEA-2 的密码分析攻击。
安全与密码学2021 · 487 分 · 107 评专业 · 约 90 分钟编辑精选Signal 消息协议的形式化安全分析
A Formal Security Analysis of the Signal Messaging Protocol
用形式化方法分析 Signal 消息协议（TextSecure）的安全性：作者在多阶段密钥交换模型下，借助自动化证明工具对协议的密钥协商与 Double Ratchet 密钥更新…
安全与密码学2016 · 353 分 · 230 评专业 · 约 120 分钟编辑精选A2：模拟恶意硬件
A2: Analog Malicious Hardware
论文研究如何在芯片设计阶段植入模拟电路形式的恶意硬件后门，使其难以被常规检测发现。
安全与密码学2016 · 315 分 · 94 评专业 · 约 75 分钟编辑精选