<story><title>TrueCrypt Security Assessment [pdf]</title><url>https://opencryptoaudit.org/reports/iSec_Final_Open_Crypto_Audit_Project_TrueCrypt_Security_Assessment.pdf</url></story><parent_chain><item><author>sigil</author><text>&lt;i&gt;The iteration count used by TrueCrypt [in its PBKDF2 key derivation] is either 1000 or 2000, depending on the hash function and use case. In both cases, this iteration count is too small to prevent password guessing attacks for even moderately complex passwords.&lt;/i&gt;&lt;p&gt;Until TrueCrypt gets patched to use scrypt for key derivation, roughly how long should a volume password be to put it out of reach?&lt;p&gt;Edit: There&amp;#x27;s a table in the scrypt paper from 2002 [1] that estimates the cost of various brute force attacks. Back then, a PBKDF2 iteration count of 86,000 and a password of length 40 would cost $200K to crack. TrueCrypt&amp;#x27;s choice of 1000-2000 iterations look staggeringly low in comparison. And that&amp;#x27;s not even accounting for hardware advances in the last 12 years.&lt;p&gt;[1] page 14, &lt;a href=&quot;http://www.tarsnap.com/scrypt/scrypt.pdf&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;www.tarsnap.com&amp;#x2F;scrypt&amp;#x2F;scrypt.pdf&lt;/a&gt;</text></item></parent_chain><comment><author>ef47d35620c1</author><text>I do not think this is significantly new as it has been documented in the official TC source code and various 3rd-party source code (TCHead, tcplay, etc.) for many years.&lt;p&gt;I was the first to crack the majority of the TrueCrypt volumes in the 2012 &lt;i&gt;&lt;/i&gt;&lt;i&gt;Defcon - Crack Me if You Can&lt;/i&gt;&lt;i&gt;&lt;/i&gt; password cracking contest using TCHead running on an old Intel Celeron processor.&lt;p&gt;Write-up: &lt;a href=&quot;http://16s.us/software/wm/Defcon/cmiyc_2012.txt&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;16s.us&amp;#x2F;software&amp;#x2F;wm&amp;#x2F;Defcon&amp;#x2F;cmiyc_2012.txt&lt;/a&gt;&lt;p&gt;Contest Page (3rd table down): &lt;a href=&quot;http://contest-2012.korelogic.com/stats.html&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;contest-2012.korelogic.com&amp;#x2F;stats.html&lt;/a&gt;&lt;p&gt;TCHead: &lt;a href=&quot;http://16s.us/software/TCHead/&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;16s.us&amp;#x2F;software&amp;#x2F;TCHead&amp;#x2F;&lt;/a&gt;</text></comment>
<story><title>TrueCrypt Security Assessment [pdf]</title><url>https://opencryptoaudit.org/reports/iSec_Final_Open_Crypto_Audit_Project_TrueCrypt_Security_Assessment.pdf</url></story><parent_chain><item><author>sigil</author><text>&lt;i&gt;The iteration count used by TrueCrypt [in its PBKDF2 key derivation] is either 1000 or 2000, depending on the hash function and use case. In both cases, this iteration count is too small to prevent password guessing attacks for even moderately complex passwords.&lt;/i&gt;&lt;p&gt;Until TrueCrypt gets patched to use scrypt for key derivation, roughly how long should a volume password be to put it out of reach?&lt;p&gt;Edit: There&amp;#x27;s a table in the scrypt paper from 2002 [1] that estimates the cost of various brute force attacks. Back then, a PBKDF2 iteration count of 86,000 and a password of length 40 would cost $200K to crack. TrueCrypt&amp;#x27;s choice of 1000-2000 iterations look staggeringly low in comparison. And that&amp;#x27;s not even accounting for hardware advances in the last 12 years.&lt;p&gt;[1] page 14, &lt;a href=&quot;http://www.tarsnap.com/scrypt/scrypt.pdf&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;www.tarsnap.com&amp;#x2F;scrypt&amp;#x2F;scrypt.pdf&lt;/a&gt;</text></item></parent_chain><comment><author>lucb1e</author><text>&amp;gt; a password of length 40 would cost $200K to crack&lt;p&gt;I&amp;#x27;d love to see someone try. Here, an md5, those are super vulnerable right? This is a 9 character password. Piece of cake if I should believe the news.&lt;p&gt;&lt;pre&gt;&lt;code&gt;    f1f107c27cae21b5b5b01002e9c9ead8&lt;/code&gt;&lt;/pre&gt;</text></comment>