Could VeraCrypt become the next TrueCrypt?
VeraCrypt is an encryption software that is a fork of TrueCrypt. What is meant by that is that it is based on TrueCrypt source without being a mere clone of the program.
Since it is based on the popular application, it offers pretty much the same feature set that TrueCrypt makes available. This includes creating encrypted containers on hard drives and encrypting entire partitions or drives including the system partition.
According to IDRIX, the company behind VeraCrypt, it adds security enhancements to the algorithm that "makes it immune to new developments in brute-force attacks".
For example, when the system partition is encrypted, TrueCrypt uses PBKDF2-RIPEMD160 with 1000 iterations whereas in VeraCrypt we use 327661. And for standard containers and other partitions, TrueCrypt uses at most 2000 iterations but VeraCrypt uses 655331 for RIPEMD160 and 500000 iterations for SHA-2 and Whirlpool.
The downside to those changes is that it takes longer to open (read mount) encrypted partitions. The actual performance of mounted drives is however not affected by this.
Another downside is that the storage format is not compatible with TrueCrypt's storage format which means that you will still have to find a way to convert TrueCrypt partitions to VeraCrypt format.
The stop of TrueCrypt development affects VeraCrypt. Since it is based on TrueCrypt source,it is now up to IDRIX to continue development of the application. Previously, the company could use new features introduced by the TrueCrypt team which is not an option anymore at the time of writing.
The "TrueCrypt is insecure" message may also affect user perception or at least doubt when it comes to VeraCrypt. While the -- ongoing -- audit has not found any major security issues in its first stage, it may still keep some users from giving VeraCrypt a true, considering that it is based on the same source as TrueCrypt.
Mounir Idrassi, IDRIX founder and developer behind VeraCrypt on the other hand does not seem devastated by TrueCrypt's end of life statement. Quite the contrary; he told us that he had big plans for the application and believes that development could continue more quickly than before.
A Mac OS X and Linux version will be released this summer for instance, and there is development ongoing to implement SHA-2 key derivation for the encryption of system partitions.
Idrassi believes that VeraCrypt will benefit from TrueCrypt's security audit to correct any weaknesses or issues found by the audit. While this may require lots of work, he hopes that other developers may contribute to the VeraCrypt project to speed these things up.
It will be interesting to see how VeraCrypt evolves in the coming months. If things to as planned, it could rise to become a very popular TrueCrypt alternative.Advertisement