![]() ![]() While VeraCrypt is available for multiple operating systems, it is on Windows where it has the biggest impact, because there aren't many free full-disk encryption options on Windows that also allow encrypting the OS drive. The auditors thanked Mounir Idrassi and his company Idrix for working with them on resolving the identified problems and for developing what they called a "crucial open-source software" program. The XZip and XUnzip libraries which were used in VeraCrypt for various operations also had flaws, so the developer decided to replace them with the more modern and secure libzip library. Users will still be able to decrypt and access existing containers encrypted with this algorithm, but won't be able to create new ones. This makes it much less mature than the rest of the code, so it's understandable that it would have more flaws in it.Īnother change made following the audit was the removal of the Russian GOST 28147-89 encryption standard, whose implementation the auditors deemed unsafe. VeraCrypt's UEFI-compatible bootloader - a first for open-source encryption programs on Windows - was released in August and is the biggest addition to the TrueCrypt code base made by VeraCrypt's lead developer, Mounir Idrassi. TrueCrypt, which serves as the base for VeraCrypt, never had support for UEFI, forcing users to disable UEFI boot if they wanted to encrypt the system partition. ![]() Many flaws were located and fixed in VeraCrypt's bootloader for computers and OSes that use the new UEFI (Unified Extensible Firmware Interface) - the modern BIOS. Some of them are unpatched issues previously found by an older TrueCrypt audit. The audit, which was performed by French cybersecurity firm QuarksLab and was sponsored through the Open Source Technology Improvement Fund (OSTIF), found eight critical vulnerabilities, three medium risk vulnerabilities and 15 low-impact flaws. ![]()
0 Comments
Leave a Reply. |