TrueCrypt

TrueCrypt
TrueCrypt - Free Open-Source On-The-Fly Disk Encryption Software for Windows Vista/XP, Mac OS X and Linux - http://www.truecrypt.org

Linux Command Line
Install: (RPMForge) yum install truecrypt

Create volume: truecrypt -c # answer several questions

Mount volume: truecrypt [enc_file] [mount_point]

Unmount volume: truecrypt -d [mount_point] truecrypt -d  # unmount all

Mount with password passed in: truecrypt CRYPTFILE CRYPTDIR -p 'PASSWORD' -k '' --protect-hidden=no echo "PASSWORD" | truecrypt CRYPTFILE CRYPTDIR -p  -k  --protect-hidden=no

Purpose
TrueCrypt - Free Open-Source Disk Encryption - Documentation - Hidden Volume:
 * "It may happen that you are forced by somebody to reveal the password to an encrypted volume. There are many situations where you cannot refuse to reveal the password (for example, due to extortion). Using a so-called hidden volume allows you to solve such situations without revealing the password to your volume."
 * "The principle is that a TrueCrypt volume is created within another TrueCrypt volume (within the free space on the volume). Even when the outer volume is mounted, it is impossible to prove whether there is a hidden volume within it or not*, because free space on any TrueCrypt volume is always filled with random data when the volume is created** and no part of the (dismounted) hidden volume can be distinguished from random data. Note that TrueCrypt does not modify the file system (information about free space, etc.) within the outer volume in any way."

TrueCrypt - Free Open-Source Disk Encryption - Documentation - Tutorial
 * "How to Create and Use a TrueCrypt Container
 * This chapter contains step-by-step instructions on how to create, mount, and use a TrueCrypt volume. We strongly recommend that you also read the other sections of this manual, as they contain important information."

Plausible Deniability

http://en.wikipedia.org/wiki/TrueCrypt

Cold Boot Attack
Research Team Finds Security Flaw in Popular Disk Encryption Technologies
 * Laptops in "Sleep" or "Hibernation" Mode Most Vulnerable to Attack
 * the researchers show that data is vulnerable because encryption keys and passwords stored in a computer's temporary memory -- or RAM -- do not disappear immediately after losing power.

Lest We Remember: Cold Boot Attacks on Encryption Keys

True Crypt
 * Free open-source disk encryption software for Windows Vista/XP, Mac OS X, and Linux

Q. What encryption software is vulnerable to these attacks? A. We have demonstrated practical attacks against several popular disk encryption systems: BitLocker (a feature of Windows Vista), FileVault (a feature of Mac OS X), dm-crypt (a feature of Linux), and TrueCrypt (a third-party application for Windows, Linux, and Mac OS X). Since these problems result from common design limitations of these systems rather than specific bugs, most similar disk encryption applications, including many running on servers, are probably also vulnerable.

Experimenting with Memory Remanence

#!/usr/bin/env python

# a pirate's favorite chemical element a = "" while 1: a += "ARGON"

sudo strings /dev/mem | less

TrueCrypt Linux Help
$ truecrypt -h Usage: truecrypt [--auto-mount ] [--backup-headers] [--background-task] [-C] [-c] [--create-keyfile] [--delete-token-keyfiles] [-d] [--encryption ] [--explore] [--filesystem ] [-f] [--fs-options ] [--hash ] [-h] [--import-token-keyfiles] [-k ] [-l] [--list-token-keyfiles] [--load-preferences] [--mount] [-m ] [--new-keyfiles ] [--new-password ] [--non-interactive] [-p ] [--protect-hidden ] [--protection-keyfiles ] [--protection-password ] [--random-source ] [--restore-headers] [--quick] [--size ] [--slot ] [--test] [-t] [--token-lib ] [-v] [--version] [--volume-properties] [--volume-type ] [Volume path] [Mount point] --auto-mount=           Auto mount device-hosted/favorite volumes --backup-headers             Backup volume headers --background-task            Start Background Task -C, --change                 Change password or keyfiles -c, --create                 Create new volume --create-keyfile             Create new keyfile --delete-token-keyfiles      Delete security token keyfiles -d, --dismount               Dismount volume --encryption=           Encryption algorithm --explore                    Open explorer window for mounted volume --filesystem=           Filesystem type -f, --force                  Force mount/dismount/overwrite --fs-options=           Filesystem mount options --hash=                 Hash algorithm -h, --help                   Display detailed command line help --import-token-keyfiles      Import keyfiles to security token -k, --keyfiles=         Keyfiles -l, --list                   List mounted volumes --list-token-keyfiles        List security token keyfiles --load-preferences           Load user preferences --mount                      Mount volume interactively -m, --mount-options=    TrueCrypt volume mount options --new-keyfiles=         New keyfiles --new-password=         New password --non-interactive            Do not interact with user -p, --password=         Password --protect-hidden=       Protect hidden volume --protection-keyfiles=  Keyfiles for protected hidden volume --protection-password=  Password for protected hidden volume --random-source=        Use file as source of random data --restore-headers            Restore volume headers --quick                      Enable quick format --size=                 Size in bytes --slot=                 Volume slot number --test                       Test internal algorithms -t, --text                   Use text user interface --token-lib=            Security token library -v, --verbose                Enable verbose output --version                    Display version information --volume-properties          Display volume properties --volume-type=          Volume type

Synopsis:

truecrypt [OPTIONS] COMMAND truecrypt [OPTIONS] VOLUME_PATH [MOUNT_DIRECTORY]

Commands:

--auto-mount=devices|favorites Auto mount device-hosted or favorite volumes.

--backup-headers[=VOLUME_PATH] Backup volume headers to a file. All required options are requested from the user.

-c, --create[=VOLUME_PATH] Create a new volume. Most options are requested from the user if not specified on command line. See also options --encryption, -k, --filesystem, --hash, -p, --random-source, --quick, --size, --volume-type. Note that passing some of the options may affect security of the volume (see option -p for more information).

Inexperienced users should use the graphical user interface to create a hidden volume. When using the text user interface, the following procedure must be followed to create a hidden volume: 1) Create an outer volume with no filesystem. 2) Create a hidden volume within the outer volume. 3) Mount the outer volume using hidden volume protection. 4) Create a filesystem on the virtual device of the outer volume. 5) Mount the new filesystem and fill it with data. 6) Dismount the outer volume. If at any step the hidden volume protection is triggered, start again from 1).

--create-keyfile[=FILE_PATH] Create a new keyfile containing pseudo-random data.

-C, --change[=VOLUME_PATH] Change a password and/or keyfile(s) of a volume. Most options are requested from the user if not specified on command line. PKCS-5 PRF HMAC hash algorithm can be changed with option --hash. See also options -k, --new-keyfiles, --new-password, -p, --random-source, -v.

-d, --dismount[=MOUNTED_VOLUME] Dismount a mounted volume. If MOUNTED_VOLUME is not specified, all volumes are dismounted. See below for description of MOUNTED_VOLUME.

--delete-token-keyfiles Delete keyfiles from security tokens. See also command --list-token-keyfiles.

--import-token-keyfiles Import keyfiles to a security token. See also option --token-lib.

-l, --list[=MOUNTED_VOLUME] Display a list of mounted volumes. If MOUNTED_VOLUME is not specified, all volumes are listed. By default, the list contains only volume path, virtual device, and mount point. A more detailed list can be enabled by verbose output option (-v). See below for description of MOUNTED_VOLUME.

--list-token-keyfiles Display a list of all available security token keyfiles. See also command --import-token-keyfiles.

--mount[=VOLUME_PATH] Mount a volume. Volume path and other options are requested from the user if not specified on command line.

--restore-headers[=VOLUME_PATH] Restore volume headers from the embedded or an external backup. All required options are requested from the user.

--test Test internal algorithms used in the process of encryption and decryption.

--version Display program version.

--volume-properties[=MOUNTED_VOLUME] Display properties of a mounted volume. See below for description of MOUNTED_VOLUME.

MOUNTED_VOLUME: Specifies a mounted volume. One of the following forms can be used: 1) Path to the encrypted TrueCrypt volume. 2) Mount directory of the volume's filesystem (if mounted). 3) Slot number of the mounted volume (requires --slot).

Options:

--encryption=ENCRYPTION_ALGORITHM Use specified encryption algorithm when creating a new volume.

--filesystem=TYPE Filesystem type to mount. The TYPE argument is passed to mount(8) command with option -t. Default type is 'auto'. When creating a new volume, this option specifies the filesystem to be created on the new volume. Filesystem type 'none' disables mounting or creating a filesystem.

--force Force mounting of a volume in use, dismounting of a volume in use, or overwriting a file. Note that this option has no effect on some platforms.

--fs-options=OPTIONS Filesystem mount options. The OPTIONS argument is passed to mount(8) command with option -o when a filesystem on a TrueCrypt volume is mounted. This option is not available on some platforms.

--hash=HASH Use specified hash algorithm when creating a new volume or changing password and/or keyfiles. This option also specifies the mixing PRF of the random number generator.

-k, --keyfiles=KEYFILE1,KEYFILE2,KEYFILE3,.. Use specified keyfiles when mounting a volume or when changing password and/or keyfiles. When a directory is specified, all files inside it will be used (non-recursively). Multiple keyfiles must be separated by comma. Use double comma to specify a comma contained in keyfile's name. Keyfile stored on a security token must be specified as token://slot/SLOT_NUMBER/file/FILENAME. An empty keyfile (-k "") disables interactive requests for keyfiles. See also options --import-token-keyfiles, --list-token-keyfiles, --new-keyfiles, --protection-keyfiles.

-m, --mount-options=headerbak|nokernelcrypto|readonly|ro|system|timestamp|ts Specify comma-separated mount options for a TrueCrypt volume: headerbak: Use backup headers when mounting a volume. nokernelcrypto: Do not use kernel cryptographic services. readonly|ro: Mount volume as read-only. system: Mount partition using system encryption. timestamp|ts: Do not preserve host-file timestamps (note that the operating  system under certain circumstances does not alter host-file timestamps, which   may be mistakenly interpreted to mean that this option does not work). See also option --fs-options.

-p, --password=PASSWORD Use specified password to mount/open a volume. An empty password can also be specified (-p ""). Note that passing a password on the command line is potentially insecure as the password may be visible in the process list (see ps(1)) and/or stored in a command history file or system logs.

--protect-hidden=yes|no Write-protect a hidden volume when mounting an outer volume. Before mounting the outer volume, the user will be prompted for a password to open the hidden volume. The size and position of the hidden volume is then determined and the outer volume is mounted with all sectors belonging to the hidden volume protected against write operations. When a write to the protected area is prevented, the whole volume is switched to read-only mode. Verbose list (-v -l) can be used to query the state of the hidden volume protection. Warning message is displayed when a volume switched to read-only is being dismounted.

--protection-keyfiles=KEYFILE1,KEYFILE2,KEYFILE3,.. Use specified keyfiles to open a hidden volume to be protected. This option may be used only when mounting an outer volume with hidden volume protected. See also options -k and --protect-hidden.

--protection-password=PASSWORD Use specified password to open a hidden volume to be protected. This option may be used only when mounting an outer volume with hidden volume protected. See also options -p and --protect-hidden.

--quick Use quick format when creating a new volume. This option can be used only when creating a device-hosted volume and must not be used when creating an outer volume.

--random-source=FILE Use FILE as a source of random data (e.g., when creating a volume) instead of requiring the user to type random characters.

--slot=SLOT Use specified slot number when mounting, dismounting, or listing a volume.

--size=SIZE Use specified size in bytes when creating a new volume.

-t, --text Use text user interface. Graphical user interface is used by default if available.

--token-lib=LIB_PATH Use specified PKCS #11 security token library.

--volume-type=TYPE Use specified volume type when creating a new volume. TYPE can be 'normal' or 'hidden'. See option -c for more information on creating hidden volumes.

-v, --verbose Enable verbose output.

Examples:

Create a new volume: truecrypt -t -c

Mount a volume: truecrypt volume.tc /media/truecrypt1

Mount a volume as read-only, using keyfiles: truecrypt -m ro -k keyfile1,keyfile2 volume.tc

Mount a volume without mounting its filesystem: truecrypt --filesystem=none volume.tc

Mount a volume prompting only for its password: truecrypt -t -k "" --protect-hidden=no volume.tc /media/truecrypt1

Dismount a volume: truecrypt -d volume.tc

Dismount all mounted volumes: truecrypt -d