OS2World OLD-STATIC-BACKUP Forum

OS2 World.Com Bounty System => Open Bounties => Topic started by: miturbide on 2007.05.17, 05:10:01

Title: TrueCrypt port
Post by: miturbide on 2007.05.17, 05:10:01
Supporting thread for the TrueCrypt port (http://www.os2world.com/content/view/330/71/) bounty. The original and old bounty thread can be found here (http://www.os2world.com/cgi-bin/ultraboard/UltraBoard.cgi?action=Read&BID=83&TID=20&SID=).

Title: Re: TrueCrypt port
Post by: kim on 2007.08.03, 19:31:51
Just wondering, but what about the linux source available for TrueCrypt, can they be used at all to at least get a running CLI version of TrueCrypt under OS2? I'm ref. as well to the old thread (//http://).
Title: Re: TrueCrypt port
Post by: Andi710 on 2007.11.06, 06:18:19
What I really have in mind is a IFS or a Netdrive plugin. Neither of which need a GUI. Just some config files would work IMHO.
Title: Re: TrueCrypt port
Post by: kim on 2007.11.07, 23:44:38
I can support that; GUI would come 2nd just to get this ported to OS2 or as an command line based apps.
Title: Re: TrueCrypt port
Post by: magog on 2007.11.15, 03:17:21
Quote from: kimhav on 2007.11.07, 23:44:38
I can support that; GUI would come 2nd just to get this ported to OS2 or as an command line based apps.

Yes, command line is good enough.

Rant mode...
With all the new and shiny "terrorist laws" in germany (it's most likely the same in other countries) that are used to restrict the personal rights of every person living in this country it's time to take counteractive measures.
There are more people struck by lightning and dying than by a terrorist attack here in Germany.
Since at least 2 years the government follows the Orwell book story by spying on their people and trying to control them.
The latest addition is this new law/act (not yet signed by Mr. Koehler the Federal President - but I have no doubt that he will do it) about the storage of communication data:
QuoteAccording to plans of the German parties CDU, CSU and SPD, from 2008 onwards it will be possible to trace who has contacted whom via telephone, mobile phone or e-mail for a period of six months. In the case of mobile calls or text messages via mobile phone, the user's location will also be logged. Anonymising services will be prohibited.

People from germany can help to take legal action against the latest attempt by signing the list PLUS sending a letter (this is important) to the lawyer taking this to the Federal Constitutional Court (Bunderverfassungsgericht). This possibility ends on 19th November so do it NOW!
Here is the link (english, french,... languages can be selected at the top right corner):
http://www.vorratsdatenspeicherung.de/

Sorry for this stuff but I'm really annoyed (I have a stronger word for it but this has to be enough) by all the stuff that has been done lately by the political representatives in Berlin.
Title: Re: TrueCrypt port
Post by: warpcafe on 2007.11.15, 12:06:55
Hi Jürgen,

I fully agree with you and your feelings about what's going on in our country.
You see, I think it's quite unlikely that there will be a "federal trojan" compatible with eCS|OS2. :-)
One more reason to not run Windows, Linux (or Mac - are they on their radar too?).

Although I actually have nothing to hide to the law enforcement agencies, I somehow still want to decide at least whether or not my data (digitalized documents, ideas...) are available to them or not, that's why I want an easy way of storing data in a secured way, e.g. TrueCrypt.
It's like if they question me and I decide to not say anything: I "hide information". The same should be possible to me in matters of electronic information - even if I can get jailed for hiding it: I don't want to always hide it, I just want to have a CHOICE to do it if I want!
(Recht auf informationelle Selbstbestimmung, et.al.)

The problem for me on the other hand is that THEY cannot guarantee that once they have sneaked around my data by their spyware tools, THEY might have a security leak, leading to my data (at their systems) being published or misused by a 3rd party. Also, every backdoor which THEY use can possibly used by anybody else as well, if he knows how to open it. That is why I feel really sceptical about their ideas.

And as usual: Politicians have an idea and come up with a law without having consulted at least ONE professional who knows what the impacts are (and who knows what he is talking about, contrary to them). Our politicians have a habit of putting good ideas into bad laws because they didn't "review" the bullshit by an expert (see "Scheinselbständigkeit" stuff in 1998...)
If they were to get professional IT consulting, they would have dropped that idea a long time ago...

regards,
Thomas
Title: Re: TrueCrypt port
Post by: magog on 2007.11.15, 15:30:13
Until last year I had this tiny hardware encryption solution (Abit Secure IDE) based on eNova's X-Wall chip but it was only simple 64-Bit DES encryption that's not save any more and it was only for EIDE.
eNova now has an AES-based X-Wall encryption chip for SATA (X-Wall MX) but so far there doesn't seem to be a simple PCB you can directly attach to your SATA drive like it was possible with the old Abit Secure IDE solution with the DES encryption.
You can't even get the RAID Controllers here in germany that are equipped with this controller.
http://www.enovatech.com/

Maybe there are other hardware based solutions available.
Title: Re: TrueCrypt port
Post by: warpcafe on 2007.11.15, 23:25:19
Hi,

well there's still the Bulk Data Encryption hard disks... as you might know, as you posted in the thread
http://www.os2world.com/component/option,com_smf/Itemid,63/topic,462.0/
:-)

No idea however WHAT encryption standard it uses... a safe one I hope. ;-)

Regards,
Thomas
Title: Re: TrueCrypt port
Post by: The Blue Warper on 2007.11.16, 13:56:34
Hi!

Don't know if any of you already knows about that, but this URL might possibly come useful to someone:

http://people.cs.uu.nl/eelco/aefs/

It's an AEFS-based IFS, though I fear it may be a bit outdated nowadays.  But sources are available, so one could manage to update it to a more current encryption technology level.
I installed it once many years ago on my old PC, and it worked well.  So well that I couldn't get back again some files which I encrypted 'cause I later forgot the password I had set!  Luckily they were just files I created for test purposes only, so no real loss occurred...

Hope this may help.

P.S. - There's a review of this IFS on VOICE:

http://www.os2voice.org/vnl/past_issues/VNL0504H/vnewsf2.htm

which is where I first know about AEFS.
Title: Re: TrueCrypt port
Post by: RobertM on 2007.11.16, 19:54:12
Well, here's a couple questions to add to this thread.

(1) How difficult would it be to implement a VFS on an existing file system?

(2) How difficult would it be to implement something that essentially "superclassed" an existing file system to interact with that file system (a) before the write stage and (b) after the read stage to essentially apply the encryption before the actual write, and decrypt after the read?

Just thoughts... don't know how feasible they are... but if one or both methods worked, it might cut development time down to create a mechanism that allowed using TrueCrypt (or for that matter any encryption method) as an intermediary between reads and writes to achieve the goal.

-Robert
Title: Re: TrueCrypt port
Post by: wpswizard on 2008.02.03, 12:45:04
Quote from: The Blue Warper on 2007.11.16, 13:56:34
Hi!

Don't know if any of you already knows about that, but this URL might possibly come useful to someone:

http://people.cs.uu.nl/eelco/aefs/

It's an AEFS-based IFS, though I fear it may be a bit outdated nowadays.  But sources are available, so one could manage to update it to a more current encryption technology level.


It's certainly not outdated with regard to encryption technology. AES is the current industry standard for block encryption. If you think it's outdated you are probably a mathematician working in the cryptanalysis department of the NSA and just invented a secret algorithm to break strong encryption.

The OS/2 implementation probably has some problems wrt security. But that's more an OS/2 kernel problem (e.g. no safe memory areas). But if someone placed a trojan on your OS/2 system to use security holes of OS/2 to read your encrypted data you probably should seek for cover to make sure you won't vanish to some hidden area somewhere in asia or Guantanamo...

BTW there is now a linux port of AEFS as can be seen on the page.

    Regards Chris
Title: Re: TrueCrypt port
Post by: Andi710 on 2008.12.01, 00:05:33
Did anybody even start working on this bounty? If there is no interest at all in it, can it be closed and the funds diverted to other, more promising projects? (I am one of the sponsors and would like to see my money go to active bounties)
Title: Re: TrueCrypt port
Post by: warpcafe on 2008.12.01, 22:00:32
Hi all,

Quote from: Andi710 on 2008.12.01, 00:05:33
Did anybody even start working on this bounty? If there is no interest at all in it, can it be closed and the funds diverted to other, more promising projects? (I am one of the sponsors and would like to see my money go to active bounties)

Good point.
I was the one starting the bounty, and I think it's a general question to the bounty managers (and I think we already had this discussion...?): What are we supposed to do if nothing happens on an open bounty for *quite some* time?
- Shall the money go into a "pot" (for general increase of all other bounties)
- or should the sponsors be asked where to shift the money to?

Cheers,
Thomas
Title: Re: TrueCrypt port
Post by: chennecke on 2008.12.02, 13:30:33
Quote from: warpcafe on 2008.12.01, 22:00:32
Quote from: Andi710 on 2008.12.01, 00:05:33
Did anybody even start working on this bounty? If there is no interest at all in it, can it be closed and the funds diverted to other, more promising projects? (I am one of the sponsors and would like to see my money go to active bounties)

Good point.
I was the one starting the bounty, and I think it's a general question to the bounty managers (and I think we already had this discussion...?): What are we supposed to do if nothing happens on an open bounty for *quite some* time?
- Shall the money go into a "pot" (for general increase of all other bounties)
- or should the sponsors be asked where to shift the money to?

Clearly the second. Everything else would be embezzlement. If people donate money for a specific purpose, you cannot rededicate it without their consent. The suboptimal handling of bounties in the past has led to me withdrawing a bounty. Please make sure that others don't feel the need to do the same.

I see two possible solutions for avoiding the hassle of getting everyone's answer:

1. Update the bounty rules and add a rule that donations for a bounty will be rededicated after a certain time. However, this leaves the question who decides what project they get re-assigned to and by which criteria.

2. Change the way bounties are handled so the money isn't drawn from the donor immediately. Then you can just delete the commitments and there will be no fees for transferring the money back to the donor.
Title: Re: TrueCrypt port
Post by: kim on 2008.12.02, 20:41:15
Agree with the input that we need to change the current rules that applies. So I'm open for input on how we should change the current rules; do suggest that we use a new thread (http://www.os2world.com/component/option,com_smf/Itemid,63/topic,1356.0/) for this discussion.
Title: Re: TrueCrypt port
Post by: kim on 2008.12.02, 20:46:28
About this specific topic I would really like to see a port of TrueCrypt - what has been discussed to close down for example the SmartCard bounty and move the fundings to TrueCrypt bounty and as well I we (OS2WF board) has talked about adding additional funding to top this bounty.

So overall, I would suggest that we also go through what bounties that we should join together, what to close and where to move the fundings and finally are there specific bounties that we should try to add move funds to from OS2WF.
Title: Re: TrueCrypt port
Post by: kim on 2009.01.09, 21:53:17
Regarding this bounty; has anyone a remote clue how hard this would be to make a full or partial port of TrueCrypt? Should we try to narrow down what the basic features that we would like to see ported if a full port is not possible? Or, as mentioned earlier, should we look into something else? As said; I'm willing to add more money to this one to get something to happend and it would be great if we got a remote indication from some developer out there...
Title: Re: TrueCrypt port
Post by: Andi on 2009.01.11, 22:16:32
Quote from: kimhav on 2009.01.09, 21:53:17
Regarding this bounty; has anyone a remote clue how hard this would be to make a full or partial port of TrueCrypt? ...

I've not looked very deep into the code cause I don't think I need it, but my 2 cents -
the hardest thing and what will be never done for OS/2 -eCS I fear, is the filesystem driver. The fancy GUI will consume much time too, I think. Beside that, it should be possible to make some CLI tools which can create and work with a crypted file. A netdrive plugin should be doable too. As far as I understand TrueCrypt, this should be enough for people how feel the need for such software.

And yes, I think narrow down to that basics would  be wise.
Title: Re: TrueCrypt port
Post by: kim on 2009.01.11, 22:51:44
Skipping GUI and start with CLI interface is more than enough for me as well. Well, let's then figure out what would be the basic features then. The main feature of Truecrypt as taken from Truecrypt home page:


I would say that being able to create a virtual encrypted disk within a file and mount would be basic feature for me and initial step. Encrypt entire partition would be great; but no clue how complex this would be to accomplish and same goes for encryption of boot partition.

About encryption algorithms I would assume that needed code can be ported from linux if the code doesn't already exists for OS2 and the FS implementation I don't know if code can be used from JFS and as well earlier other FS implementation for OS2.
Title: Re: TrueCrypt port
Post by: Andi on 2009.01.12, 11:37:28
Quote from: kimhav on 2009.01.11, 22:51:44
....
I would say that being able to create a virtual encrypted disk within a file and mount would be basic feature for me and initial step. Encrypt entire partition would be great; but no clue how complex this would be to accomplish and same goes for encryption of boot partition.
Most of partition managment will be OS/2 specific and probably can not be ported from TrueCrypt. Remember, DFSee is the only partitioning tool which understands and can work with OS/2 partition/volume information. So I very raw estimate, encrypting partitions will double the effort compared to an ecrypted file bound via netdrive. Not to speak about encrypted boot partition. But, who needs an encrypted boot partition with OS/2? There's no need to have user data on the boot partition.

Title: Re: TrueCrypt port
Post by: magog on 2009.01.14, 15:45:01
For the GUI I would say it would be a good idea to create it using WDSibyl (Pascal/Delphi).
This can be done fast and is not very complicated. Even people without programming experience could click the GUI together (except for the functionality).

The GUI can be used to call the commandline applications. This way the development can be split up.

An encrypted bootdrive is indeed too much work but an encrypted partition should be doable. But I think for the start support for encrypted container files (*.tc) should be enough.

Edit: Added (*.tc) to container files --> Truecrypt container == a file containing an encrypted partition
Title: Re: TrueCrypt port
Post by: Saijin_Naib on 2009.01.14, 16:50:18
Is encrypted file containers the same as encrypting a single file? I know I can right click -> encrypt on XP a single file without having to do the whole volume.
Title: Re: TrueCrypt port
Post by: kim on 2009.01.14, 23:41:38
No, encrypted file container is a virtual volume/partion hosted within a file container. After creating a file container it's mounted to the FS and accessed as a partition.
Title: Re: TrueCrypt port
Post by: Saijin_Naib on 2009.01.14, 23:57:36
Ah, okay. I understand the difference now.
Title: Re: TrueCrypt port
Post by: Andy P. on 2010.03.13, 15:14:05
Andy wrote:
QuoteBut, who needs an encrypted boot partition with OS/2?
IMHO Truecrypt used without boot partition encrypted is dangerous. I.e. in the swapper.dat you will find many value information of the files you want to hide.
In the end, you have to protect your boot partition also.

magog  wrote:
QuoteeNova now has an AES-based X-Wall encryption chip for SATA (X-Wall MX) but so far there doesn't seem to be a simple PCB you can directly attach to your SATA drive like it was possible with the old Abit Secure IDE solution with the DES encryption.
Looking for the same solution, I could put my hands on an piece of hardware with the X-Wall MX256. Im using this chip now fpr almost one year. It is fully transparent for all operations. Installing ecs, or using DFsee is without any problems. It works as if nonexistent form the system within. It crypts sector by sector in AES256 in ECB-mode. Chips with CBC-Mode by default are only availible on request - means if you order more then 10.000 chips.
If you want such a PCB with two FOBs (no, the old DES-FOBs doesnt work) PM me.

Andy P.
Title: Re: TrueCrypt port
Post by: magog on 2010.03.14, 21:50:54
Quote from: Andy P. on 2010.03.13, 15:14:05
Andy wrote:
QuoteBut, who needs an encrypted boot partition with OS/2?
IMHO Truecrypt used without boot partition encrypted is dangerous. I.e. in the swapper.dat you will find many value information of the files you want to hide.
In the end, you have to protect your boot partition also.

It may contain names of files in more or less clear form but that's not a problem as long as you can't access the file(s) in question.
The other thing is, that you have to implement additional code (basically HPFS/bootable JFS code to the TrueCrypt code) to be able to boot from an encrypted HPFS/JFS partition. This makes it a lot more complicated. Basically this feature is only a long term goal at best.

If work on a TrueCrypt port is done the basic and easiest features to implement would be sufficient for the moment (a TrueCrypt container file and the mount container file as partition function).

Quote from: Andy P. on 2010.03.13, 15:14:05magog  wrote:
QuoteeNova now has an AES-based X-Wall encryption chip for SATA (X-Wall MX) but so far there doesn't seem to be a simple PCB you can directly attach to your SATA drive like it was possible with the old Abit Secure IDE solution with the DES encryption.
Looking for the same solution, I could put my hands on an piece of hardware with the X-Wall MX256. Im using this chip now fpr almost one year. It is fully transparent for all operations. [..]
If you want such a PCB with two FOBs (no, the old DES-FOBs doesnt work) PM me.

Interesting, you get a PM shortly.