“As to the criticism about the way they abruptly shut down, all I know is that if your only face to the public is a website and email, and the only verification of trust is a signature key, and all are gone or in question, I’m not clear what remains of the TrueCrypt team anymore. “The best evidence I’ve seen so far is that it’s what they say on the surface: they’ve been at this for 10 years they started in their late 20s and they’re not interested in doing this anymore,” White said, adding that he tried to reach out to the team through the channels that proved successful last fall when the audit movement began, but to no avail. “The best evidence I’ve seen so far is that it’s what they say on the surface.” Were they served with a secret court order for encryption keys, a la Lavabit, and the shutdown was a warrant canary? Was the software hacked beyond repair? Or were they simply 10 years into a project and no longer wanted to pursue such a project in this environment of surveillance and scrutiny? A critical vulnerability in OpenSSL was at the center of the Heartbleed storm.Īfter a bizarre week during which the anonymous TrueCrypt developers cryptically announced that their software was unsafe and development had shut down, the suddenness, uncertainty and mystery of their action kicked off reams of speculation about possible reasons. OCAP has reportedly raised upwards of $70,000, almost tripling the group’s initial funding goals and already they’ve pledged to coordinate an audit of OpenSSL, which will be funded by the Linux Foundation under its Core Infrastructure Initiative. It’s an important point that we don’t want people to feel like they contributed to an audit and we’re funneling money to a development project.” “We’re not set up to do software development. “I want to be really clear about this: We are considering several scenarios, including potentially supporting a fork, but we’re certainly not doing it before the audit is done,” said Kenneth White, who along with Johns Hopkins professor Matthew Green kickstarted the TrueCrypt audit and OCAP.

The first phase of the audit, conducted by iSec Partners examining the TrueCrypt bootloader and kernel driver, found no backdoors phase two, to begin shortly, will examine the cryptography holding up TrueCrypt. OCAP is the brand name for the grassroots movement that arose out of the ashes of the Snowden revelations and concerns about the integrity of TrueCrypt, which has been downloaded close to 30 million times. TrueCrypt may yet get forked, but it won’t come at the hands of the Open Crypto Audit Project (OCAP), which has a working plan to move forward with a cryptanalysis of the open source encryption software.

How to crack truecrypt bootloader