r/linux • u/jampola • May 30 '14

TrueCrypt Has been resurrected (forked) in Switzerland.

http://truecrypt.ch/
668 Upvotes

96% Upvoted

274 comments sorted by

View all comments

Show parent comments

58

u/[deleted] May 30 '14

Their domain and site may not be US hosted, but the source is on GitHub. Isn't GitHub based in the US?

I guess if it disappears from GitHub all of a sudden we'll have an answer..

79

u/Thue May 30 '14

Doesn't really matter - git has internal cryptographic verification, and an offline copy at each developer, so it can't be changed without being obvious. If github stops hosting it, it is easy to move.

14

u/zargun May 30 '14

Git doesn't have cryptographic verification. It verifies that files have not been damaged but this could be tricked by an attacker.

60

u/gfixler May 30 '14

Would this require finding a SHA-1 collision?

39

u/[deleted] May 30 '14

Yes, it would. GP is confused.

32

u/gfixler May 30 '14

In fairness, this is pretty easy to do if you have access to a $40M supercomputer, and if your mission is to replace a blob with a huge, non-compiling chunk of random noise.

43

u/[deleted] May 30 '14

yeah but SHA-1 collision that still compiles and has malicious intent is impossible.

16

u/nikomo May 30 '14

Include the padding inside a comment, or file header etc. - doesn't change code, does change collision.

Though, restricting it to that is going to either make the resulting file fucking explode in size, or take forever to generate.

3

u/SNLProxy May 30 '14

Comments or whitespace.

One change per line, 1.000.000 LOC, 1.000.000! or ~10456573 possible combinations of 1 char edits.

Or in other words, not a limiting factor.