Penetration Test Report (Fraunhofer): Fraunhofer   TrueCrypt

Security Analysis of
TrueCrypt
November 16, 2015
Authors
This study was executed by the Fraunhofer Institute for Secure Information Technology on
behalf of the Federal Office for Information Security. This publication was authored by
Mauro Baluda
Andreas Fuchs
Philipp Holzinger
Lotfi ben Othmane
Andreas Poller
Jürgen Repp
Johannes Späth
Jan Steffan
Stefan Triller
Eric Bodden
Fraunhofer Institute for Secure Information Technology
Rheinstraße 75
64295 Darmstadt
Germany
The authors wish to thank Andreas Junestam and Nicolas Guigo of the Open Crypto Audit
Project for clarifications regarding their own security assessment of TrueCrypt. Thanks go
also to Andreas Follner, Technische Universtät Darmstadt, who gave valueable input
regarding the exploitability of buffer-overflow vulnerabilities that the OCAP-report
mentions.
Federal Office for Information Security
Post Box 20 03 63
D-53133 Bonn
Phone: +49 22899 9582-0
E-Mail: bsi@bsi.bund.de
Internet: https://www.bsi.bund.de
© Federal Office for Information Security 2015
Security Analysis of TrueCrypt
Contents
1 Summary 6
1.1 Aim . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
1.2 Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
1.3 Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2 Analysis of the differences between versions 7.0a and 7.1a 9
2.1 Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2.2 Differences relevant to security . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2.3 Other differences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
2.4 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
3 Evaluation of the OCAP Phase 1 Test Report 13
3.1 Comments on OCAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
3.1.1 Scope of the report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
3.1.2 Comments on the individual findings of the OCAP report . . . . . . . . . 13
3.1.3 Detailed manual analysis of Finding 3 . . . . . . . . . . . . . . . . . . . . 15
3.1.4 Checking the findings using Coverity . . . . . . . . . . . . . . . . . . . . . 16
3.2 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
4 Review of the encryption mechanisms 18
4.1 Encryption algorithms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
4.2 Key derivation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
4.3 Random number generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
4.4 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
5 Evaluation using automated code analysis 26
5.1 Overview of the results of the analysis . . . . . . . . . . . . . . . . . . . . . . . . 28
5.2 Details on the error reports and recommendations . . . . . . . . . . . . . . . . . 29
5.2.1 Clang Static Analyzer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
5.2.2 Coverity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
5.2.3 Cppcheck . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
5.3 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
6 Evaluation of the code quality and documentation 36
6.1 Evaluation of the code quality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
6.1.1 Programming guidelines and best practices . . . . . . . . . . . . . . . . . 36
6.1.1.1 Violation of generally accepted rules . . . . . . . . . . . . . . . . 36
6.1.1.2 Multiple return statements . . . . . . . . . . . . . . . . . . . . . 37
6.1.1.3 Application logic within header files . . . . . . . . . . . . . . . . 37
6.1.2 Complexity of the source code. . . . . . . . . . . . . . . . . . . . . . . . . 38
6.1.3 Code Clones. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
6.1.4 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Federal Office for Information Security iii
Security Analysis of TrueCrypt
6.2 Evaluation of the documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
6.3 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
7 Conceptual evaluation of the architecture 42
7.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
7.2 Context and use cases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
7.3 Security goals and requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
7.4 Attack strategies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
7.4.1 Preliminary considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
7.4.2 Overview of attacks with physical access . . . . . . . . . . . . . . . . . . . 46
7.4.3 Detailed overview of the attack strategies . . . . . . . . . . . . . . . . . . 47
7.4.3.1 Brute force attacks . . . . . . . . . . . . . . . . . . . . . . . . . . 47
7.4.3.2 Forensic analysis of unencrypted data in the IT system . . . . . 48
7.4.3.3 Detection of passwords and keys using cyber espionage . . . . . 48
7.4.3.4 Side-channel attacks . . . . . . . . . . . . . . . . . . . . . . . . . 49
7.4.3.5 Attacks with logical access to the IT system . . . . . . . . . . . 50
7.4.3.6 Indirect attacks without physical access to the system . . . . . . 50
7.4.3.7 Attacks via backdoors . . . . . . . . . . . . . . . . . . . . . . . . 50
7.4.3.8 Altering encrypted data . . . . . . . . . . . . . . . . . . . . . . . 51
7.4.4 Preliminary conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
7.4.5 Comparison with the security model used by TrueCrypt . . . . . . . . . . 52
7.5 Evaluation of the architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
7.5.1 An overview of the components . . . . . . . . . . . . . . . . . . . . . . . . 53
7.5.2 The core functionality of TrueCrypt . . . . . . . . . . . . . . . . . . . . . 54
7.5.3 Maintainability and testability . . . . . . . . . . . . . . . . . . . . . . . . 59
7.5.4 Recommendations for improvements . . . . . . . . . . . . . . . . . . . . . 60
7.6 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
8 Identification of dispensable parts of the code 62
8.1 Aim . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
8.2 Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
8.3 Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
9 Evaluation of the OCAP Phase 2 Test Report 64
9.1 Comments on OCAP-2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
9.2 Comments on the results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
9.3 Further findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
9.4 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
A Functions with a cyclomatic complexity greater than 15 69
B Duplicate code (excerpt) 72
C Detail of the static analysis tools’ warnings 74
iv Federal Office for Information Security
Security Analysis of TrueCrypt
List of Tables
4.1 Available algorithms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
4.2 Format of the test data for symmetric encryption . . . . . . . . . . . . . . . . . . 22
4.3 TrueCrypt / OpenSSL key derivation functions . . . . . . . . . . . . . . . . . . . 22
4.4 Format of the test data for the key derivation . . . . . . . . . . . . . . . . . . . . 24
5.1 Risk level for the Clang results . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
5.2 Risk level for the Coverity results for Linux . . . . . . . .