Esistono forchette TrueCrypt ragionevoli?

L'ostacolo principale di una forcella TrueCrypt è la licenza TrueCrypt non standard.

Mentre l'intenzione degli autori sembrava essere quella di scrivere una licenza simile allo stesso spirito alla GPL, la licenza ha alcuni passaggi abbastanza non ortodossi che possono essere interpretati in un modo che pone condizioni irragionevoli su una forcella. Queste condizioni impedivano a Open Source Initiative di riconoscerla come una licenza open source. Un fork del progetto TrueCrypt potrebbe non essere legalmente possibile senza il permesso degli autori originali di TrueCrypt, che preferiscono rimanere anonimi per ora.

Tuttavia, esiste una squadra in Svizzera che ha promesso di continuare a lavorare su TrueCrypt con il nome TrueCryptNext .

Modifica: ora c'è la società Sirrix dalla Germania che vuole per creare un fork TrueCrypt chiamato TrustedDisk. Per sbarazzarsi della complicata licenza TrueCrypt, progettano di reimplementare quelle parti con condizioni di licenza discutibili e rilasciare il software con doppia licenza sia con una licenza open source comune che con una versione commerciale ( notizie tedesche ).

In particolare, per le licenze di TrueCrypt sono già in corso discussioni: Semplicemente perché le persone principali dietro al progetto sono anonime (alcuni pensano che provengano dall'Europa orientale come il ceco) e data la possibilità di lettere di sicurezza nazionale (come lavabit) sarebbe anche meglio per loro stare sotto la copertura (Sidenote: sarebbe essere abbastanza se fossero costretti a dare via la loro chiave privata di firma gpg, quindi le nuove versioni non sono più affidabili)

Il lato positivo di questo è che nel caso di un fork devono prima rivelare il loro id per rivendicare i possibili diritti di licenza.

In ogni caso, l'audit di sicurezza sta per stage2 ora (anche se il progetto è spento) per vedere se quella versione era sicura.

UPDATE : sembra che inizi un fork qui link

Ho appena scoperto VeraCrypt .

It adds enhanced security to the algorithms used for system and partitions encryption making it immune to new developments in brute-force attacks.

For example, when the system partition is encrypted, TrueCrypt uses PBKDF2-RIPEMD160 with 1000 iterations whereas in VeraCrypt we use 327661. And for standard containers and other partitions, TrueCrypt uses at most 2000 iterations but VeraCrypt uses 655331 for RIPEMD160 and 500000 iterations for SHA-2 and Whirlpool.

This enhanced security adds some delay only to the opening of encrypted partitions without any performance impact to the application use phase. This is acceptable to the legitimate owner but it makes it much more harder for an attacker to gain access to the encrypted data.

VeraCrypt storage format is INCOMPATIBLE with TrueCrypt storage format.

Ecco la sezione pertinente della licenza. La mia interpretazione non legale della licenza è che hai il permesso di modificarlo, purché tu:

1. non chiamarlo TrueCrypt (o basare il nome su TrueCrypt)
2. non sostengono che si tratti di una versione di TrueCrypt Foundation,
3. afferma che è basato su TrueCrypt disponibile gratuitamente su truecrypt.org,
4. fornisci gratuitamente la fonte per tutte le tue modifiche se distribuisci il tuo sorgente,
5. usa la stessa licenza di TrueCrypt

Ho inserito la licenza completa in un pastebin preso da License.txt incluso nel sorgente TrueCrypt 7.1a disponibile qui . Ecco le sezioni più pertinenti:

III. Modification, Derivation, and Inclusion in Other Products

1. If all conditions specified in the following paragraphs in this Chapter (III) are met (for exceptions, see Section III.2) and if You comply with all other applicable terms and conditions of this License, You may modify This Product (thus forming Your Product), derive new works from This Product or portions thereof (thus forming Your Product), include This Product or portions thereof in another product (thus forming Your Product, unless defined otherwise in Chapter I), and You may use (for non- commercial and/or commercial purposes), copy, and/or distribute Your Product.

   a. The name of Your Product (or of Your modified version of This Product) must not contain the name TrueCrypt (for example, the following names are not allowed: TrueCrypt, TrueCrypt+, TrueCrypt Professional, iTrueCrypt, etc.) nor any other names confusingly similar to the name TrueCrypt (e.g., True-Crypt, True Crypt, TruKrypt, etc.)

   All occurrences of the name TrueCrypt that could reasonably be considered to identify Your Product must be removed from Your Product and from any associated materials. Logo(s) included in (or attached to) Your Product (and in/to associated materials) must not incorporate and must not be confusingly similar to any of the TrueCrypt logos (including, but not limited to, the non-textual logo consisting primarily of a key in stylized form) or portion(s) thereof. All graphics contained in This Product (logos, icons, etc.) must be removed from Your Product (or from Your modified version of This Product) and from any associated materials.

   b. The following phrases must be removed from Your Product and from any associated materials, except the text of this License: "A TrueCrypt Foundation Release", "Released by TrueCrypt Foundation", "This is a TrueCrypt Foundation release."

   c. Phrase "Based on TrueCrypt, freely available at http://www.truecrypt.org/" must be displayed by Your Product (if technically feasible) and contained in its documentation. Alternatively, if This Product or its portion You included in Your Product constitutes only a minor portion of Your Product, phrase "Portions of this product are based in part on TrueCrypt, freely available at http://www.truecrypt.org/" may be displayed instead. In each of the cases mentioned above in this paragraph, "http://www.truecrypt.org/" must be a hyperlink (if technically feasible) pointing to http://www.truecrypt.org/ and You may freely choose the location within the user interface (if there is any) of Your Product (e.g., an "About" window, etc.) and the way in which Your Product will display the respective phrase.

   Your Product (and any associated materials, e.g., the documentation, the content of the official web site of Your Product, etc.) must not present any Internet address containing the domain name truecrypt.org (or any domain name that forwards to the domain name truecrypt.org) in a manner that might suggest that it is where information about Your Product may be obtained or where bugs found in Your Product may be reported or where support for Your Product may be available or otherwise attempt to indicate that the domain name truecrypt.org is associated with Your Product.

   d. The complete source code of Your Product must be freely and publicly available (for exceptions, see Section III.2) at least until You cease to distribute Your Product. This condition can be met in one or both of the following ways: (i) You include the complete source code of Your Product with every copy of Your Product that You make and distribute and You make all such copies of Your Product available to the general public free of charge, and/or (ii) You include information (valid and correct at least until You cease to distribute Your Product) about where the complete source code of Your Product can be obtained free of charge (e.g., an Internet address) or for a reasonable reproduction fee with every copy of Your Product that You make and distribute and, if there is a web site officially associated with Your Product, You include the aforementioned information about the source code on a freely and publicly accessible web page to which such web site links via an easily viewable hyperlink (at least until You cease to distribute Your Product).

   The source code of Your Product must not be deliberately obfuscated and it must not be in an intermediate form (e.g., the output of a preprocessor). Source code means the preferred form in which a programmer would usually modify the program.

   Portions of the source code of Your Product not contained in This Product (e.g., portions added by You in creating Your Product, whether created by You or by third parties) must be available under license(s) that (however, see also Subsection III.1.e) allow(s) anyone to modify and derive new works from the portions of the source code that are not contained in This Product and to use, copy, and redistribute such modifications and/or derivative works. The license(s) must be perpetual, non-exclusive, royalty-free, no-charge, and worldwide, and must not invalidate, weaken, restrict, interpret, amend, modify, interfere with or otherwise affect any part, term, provision, or clause of this License. The text(s) of the license(s) must be included with every copy of Your Product that You make and distribute.

   e. You must not change the license terms of This Product in any way (adding any new terms is considered changing the license terms even if the original terms are retained), which means, e.g., that no part of This Product may be put under another license. You must keep intact all the legal notices contained in the source code files. You must include the following items with every copy of Your Product that You make and distribute: a clear and conspicuous notice stating that Your Product or portion(s) thereof is/are governed by this version of the TrueCrypt License, a verbatim copy of this version of the TrueCrypt License (as contained herein), a clear and conspicuous notice containing information about where the included copy of the License can be found, and an appropriate copyright notice.

2. You are not obligated to comply with Subsection III.1.d if Your Product is not distributed (i.e., Your Product is available only to You).

Ci sono anche clausole di legalità discutibile; ad esempio, nella Sezione VI ci sono due clausole che dicono se "non capisci tutte le parti della licenza" O che se una qualsiasi disposizione della licenza non è applicabile allora NON PUOI UTILIZZARE, COPIARE o MODIFICARE il loro codice sorgente. Non sono un avvocato, ma queste clausole mi sembrano strane e potenzialmente inapplicabili. Questo ti lascerebbe non avere il diritto di utilizzare anche TrueCrypt, per non parlare di creare un'opera derivata che rispetti le regole della Sezione III.

1. IF YOU ARE NOT SURE WHETHER YOU UNDERSTAND ALL PARTS OF THIS LICENSE OR IF YOU ARE NOT SURE WHETHER YOU CAN COMPLY WITH ALL TERMS AND CONDITIONS OF THIS LICENSE, YOU MUST NOT USE, COPY, MODIFY, CREATE DERIVATIVE WORKS OF, NOR (RE)DISTRIBUTE THIS PRODUCT, NOR ANY PORTION(S) OF IT. YOU SHOULD CONSULT WITH A LAWYER.

2. IF (IN RELEVANT CONTEXT) ANY PROVISION OF CHAPTER IV OF THIS LICENSE IS UNENFORCEABLE, INVALID, OR PROHIBITED UNDER APPLICABLE LAW IN YOUR JURISDICTION, YOU HAVE NO RIGHTS UNDER THIS LICENSE AND YOU MUST NOT USE, COPY, MODIFY, CREATE DERIVATIVE WORKS OF, NOR (RE)DISTRIBUTE THIS PRODUCT, NOR ANY PORTION(S) THEREOF.

Breve net-walk dall'articolo WikiPedia collegato da ignis portami a TcPlay , una reimplementazione indipendente di TrueCrypt. Sfortunatamente supporta solo Linux e DragonFly BSD. È persino incluso nella maggior parte delle distribuzioni pertinenti.