At the end of each official .exe and .sys file, there are embedded digital signatures and all related certificates (i.e. all certificates in the relevant certification chain, such as the certification authority certificates, CA-MS cross-certificate, and the TrueCrypt Foundation certificate). Keep this in mind if you compile TrueCrypt and compare your binaries with the official binaries. If your binaries are unsigned, the sizes of the official binaries will usually be approximately 10 KB greater than sizes of your binaries (there may be further differences if you use a different version of the compiler, or if you install a different or no service pack for Visual Studio, or different hotfixes for it, or if you use different versions of the required SDKs).
Re:A public TrueCrypt Audit
by jl6 on Wednesday October 09, 2013 @04:22PM
(#6523571)
If you compiled the source and obtained exactly the same binary as is offered for download, would that prove the binary was unmolested? I'm guessing there are many reasons why the binary might turn out to be different for non-suspicious reasons (different compiler versions/flags/environment...?), in which case would it be hard to enumerate all those reasons and rule them all out as the cause of a difference?
[ Parent
| on HN ]
There are many more reasons than that. Getting a deterministic binary is a achievement in and of itself:
It could still be useful to try a tool like zynamics bindiff to compare a build from the source against the binary download.
Re:A public TrueCrypt Audit
by WizzleKake on Wednesday October 09, 2013 @04:28PM
(#6523612)
Yes - they acknowledge this in the Readme.txt for the source:
Plus I guess Visual Studio could be backdoored to recognise the TrueCrypt source code and insert malicious code?
Not only technically very difficult, but requires the MS VC++ team to be complicit and silent. I'd put it pretty far down the list.
Re:A public TrueCrypt Audit
by DigitalJack on Wednesday October 09, 2013 @08:11PM
(#6524827)
Not that hard to imagine anymore, with National Security Letters and whatnot.
Then compile it with gcc on cygwin and/or llvm and compare.
Then it won't match. Your only hope of getting exactly the same binary is to use the same compiler with all the same settings.
It can easily be reverse engineered.
Re:A public TrueCrypt Audit
by michaelmior on Wednesday October 09, 2013 @04:37PM
(#6523680)
If you have verified the source code and the build process is sound and you produce the exact same binary as the distribution, then yes. But you're right that it's unlikely you'll produce _exactly_ the same binary. If you don't trust the source, the best way to be sure is to compile yourself.