TrueCrypt suggesting migration to BitLocker?

Re:TrueCrypt suggesting migration to BitLocker? by GoodOlClint on Wednesday May 28, 2014 @05:18PM (#7813027)

This looks like the previous key: https://github.com/DrWhax/truecrypt-archive/blob/master/True...

Besides the different file name, the contents of the files match: http://www.diffchecker.com/szpb500v

[ Parent | on HN ]

Re:TrueCrypt suggesting migration to BitLocker? by eric_bullington on Wednesday May 28, 2014 @08:16PM (#7813862)

Yes, I can confirm that F0D6B1E0 was on the Truecrypt web site about a year or two ago, since it's been on my keyring for at least that long. I've installed Truecrypt multiple times over the past few years, and have always used this key to verify (or its signing subkey, I suppose).

[ Parent | on HN ]

Re:TrueCrypt suggesting migration to BitLocker? by LeoPanthera on Wednesday May 28, 2014 @05:20PM (#7813042)

There's a "TrueCrypt Foundation" key on the keyservers from 2004, the ID is E3BA73CAF0D6B1E0.

[ Parent | on HN ]

Re:TrueCrypt suggesting migration to BitLocker? by throwaway8889 on Wednesday May 28, 2014 @07:41PM (#7813733)

The time stamp on key servers can not be trusted. Anyone can spoof keys in anyone elses name, with any timestamp they want.

The only way to verify is if you have the previous key stored somewhere, or can find a trustpath to it.

[ Parent | on HN ]

Re:TrueCrypt suggesting migration to BitLocker? by adrianN on Wednesday May 28, 2014 @08:02PM (#7813808)

I have the key stored in my local keychain:

E3BA73CAF0D6B1E0 C5F4 BAC4 A7B2 2DB8 B8F8 5538 E3BA 73CA F0D6 B1E0

Checks out.

[ Parent | on HN ]

Re:TrueCrypt suggesting migration to BitLocker? by panarky on Thursday May 29, 2014 @12:54AM (#7814816)

I have 7.1a binaries, source, sigs and pub key from September 2013.

  pub   1024D/F0D6B1E0 2004-06-06
        Key fingerprint = C5F4 BAC4 A7B2 2DB8 B8F8  5538 E3BA 73CA F0D6 B1E0
  uid                  TrueCrypt Foundation <[email protected]>
  sub   4077g/6B136ECF 2004-06-06

My version from September is identical to the pub key at http://sourceforge.net/projects/truecrypt/files/TrueCrypt/Ot... .

[ Parent | on HN ]

Re:TrueCrypt suggesting migration to BitLocker? by voltagex_ on Thursday May 29, 2014 @01:00AM (#7814825)

Could you post the SHA1s of those? I'm failing to use GPG properly.

[ Parent | on HN ]

Re:TrueCrypt suggesting migration to BitLocker? by panarky on Thursday May 29, 2014 @09:33AM (#7816109)

  tc/linux$ sha1sum *
  c2a8c78a23f97ffb17bf47448c9f2daa3c8f80cd  truecrypt-7.1a-linux-console-x64.tar.gz
  078cdd4a58f0342cb872d7456c0ba49e310fcad9  truecrypt-7.1a-linux-console-x64.tar.gz.sig
  a53a7a609a25d9a1e33f720ce5c0265ddd4e8b25  truecrypt-7.1a-linux-console-x86.tar.gz
  66060f9444d5df70b4fcdeb655dc60131fce5ad1  truecrypt-7.1a-linux-console-x86.tar.gz.sig
  086cf24fad36c2c99a6ac32774833c74091acc4d  truecrypt-7.1a-linux-x64.tar.gz
  45f65bf755d9481d8afa0d17de6a034062b7a7bd  truecrypt-7.1a-linux-x64.tar.gz.sig
  0e77b220dbbc6f14101f3f913966f2c818b0f588  truecrypt-7.1a-linux-x86.tar.gz
  9efcd79e963126d6d8ef242857b4fafb06eb8ff0  truecrypt-7.1a-linux-x86.tar.gz.sig
  d43e0dbe05c04e316447d87413c4f74c68f5de24  TrueCrypt 7.1a Source.tar.gz
  caeb2bb1d5605d1fc960e936a06e52611033788c  TrueCrypt 7.1a Source.tar.gz.sig
  c871f833d6c115f4b4861eed859ff512e994b9fc  TrueCrypt-Foundation-Public-Key.asc

  tc/windows$ sha1sum *
  06961d83e39c7248df09c132cb6e9b9f528ce69a  Configuration.xml
  88b323b416290924621901a10da3f4f7482e3f77  License.txt
  4c4891f5eafcf9b96be01e31031992d9e98d39c3  TrueCrypt.exe
  34442e400e6cb2534f33a0b1599defe36eefef2a  TrueCrypt Format.exe
  7689d038c76bd1df695d295c026961e50e4a62ea  TrueCrypt Setup 7.1a.exe
  e1e3efaeac2fbcdbff0c2c62ac33233bd356edfa  TrueCrypt Setup 7.1a.exe.sig
  62fc4f76540740e63c7f0a33e3a1b66411f0a303  truecrypt.sys
  17249d979b3bc52d0a33821cc7f810337ddea2b6  TrueCrypt User Guide.pdf
  17c46ebc6f4977afbcf4aa11eccee524fd95b1c8  truecrypt-x64.sys

[ Parent | on HN ]

Re:TrueCrypt suggesting migration to BitLocker? by gap on Thursday May 29, 2014 @03:54PM (#7818242)

Can you please make these available for download, the Linux ones at least?

[ Parent | on HN ]

Re:TrueCrypt suggesting migration to BitLocker? by ixwt on Thursday May 29, 2014 @10:55PM (#7819989)

All of the files available here: http://truecrypt.ch/ have the same hashes as provided by this person.

[ Parent | on HN ]

Re:TrueCrypt suggesting migration to BitLocker? by panarky on Thursday May 29, 2014 @11:36PM (#7820130)

Don't just trust my SHA1s, verify with the sigs and the TrueCrypt Foundation public key. Ensure the key has the fingerprint shown in the great-great-great grandparent of this comment, independently verified by others in this thread.

  gpg --import TrueCrypt-Foundation-Public-Key.asc
  gpg --fingerprint F0D6B1E0
  gpg --verify truecrypt-7.1a-linux-x64.tar.gz.sig

You should see:

  gpg: Signature made Tue 07 Feb 2012 12:45:26 PM PST using DSA key ID F0D6B1E0
  gpg: Good signature from "TrueCrypt Foundation <[email protected]>"
  gpg: WARNING: This key is not certified with a trusted signature!
  gpg:          There is no indication that the signature belongs to the owner.
  Primary key fingerprint: C5F4 BAC4 A7B2 2DB8 B8F8  5538 E3BA 73CA F0D6 B1E0

[ Parent | on HN ]

Re:TrueCrypt suggesting migration to BitLocker? by gap on Friday May 30, 2014 @02:11PM (#7823184)

Thanks!

[ Parent | on HN ]