[andy]

Napisany przez teleimpact

Cześć,
nigdzie nie mogę znaleźć dokładniejszego opisu na jakiej zasadzie działa TrueCrypt, w przypadku szyfrowania przenośnego dysku lub pendrive.
Dokładnie chodzi o to że gdy zaszyfruję przykładowo pendrive, tworzony jest unikalny klucz. Tu pojawia się pytanie, czy gdy zainstaluję TrueCrypt na innym komputerze, podepnę pendrive i podam hasło, w jaki sposób program będzie wiedział jakiego klucza użyto do zaszyfrowania hasła? Skoro ciąg znaków jest losowy?

Tutaj masz napisane jak działa deszyfrowanie.

1. The first 512 bytes of the volume (i.e., the standard volume header) are read into RAM, out of which the first 64 bytes are the salt (see TrueCrypt Volume Format Specification). For system encryption (see the chapter System Encryption), the last 512 bytes of the first logical drive track are read into RAM (the TrueCrypt Boot Loader is stored in the first track of the system drive and/or on the TrueCrypt Rescue Disk).
2. Bytes 65536***8211;66047 of the volume are read into RAM (see the section TrueCrypt Volume Format Specification). For system encryption, bytes 65536***8211;66047 of the first partition located behind the active partition* are read into RAM (see the section Hidden Operating System). If there is a hidden volume within this volume (or within the partition behind the active partition), we have read its header at this point; otherwise, we have just read random data (whether or not there is a hidden volume within it has to be determined by attempting to decrypt this data; for more information see the section Hidden Volume).
3. Now TrueCrypt attempts to decrypt the standard volume header read in (1). All data used and generated in the course of the process of decryption are kept in RAM (TrueCrypt never saves them to disk). The following parameters are unknown** and have to be determined through the process of trial and error (i.e., by testing all possible combinations of the following):
   1. PRF used by the header key derivation function (as specified in PKCS #5 v2.0; see the section Header Key Derivation, Salt, and Iteration Count), which can be one of the following:
      
      HMAC-SHA-512, HMAC-RIPEMD-160, HMAC-Whirlpool.
      
      A password entered by the user (to which one or more keyfiles may have been applied ***8211; see the section Keyfiles) and the salt read in (1) are passed to the header key derivation function, which produces a sequence of values (see the section Header Key Derivation, Salt, and Iteration Count) from which the header encryption key and secondary header key (XTS mode) are formed. (These keys are used to decrypt the volume header.)
   2. Encryption algorithm: AES-256, Serpent, Twofish, AES-Serpent, AES-Twofish-Serpent, etc.
   3. Mode of operation: XTS, LRW (deprecated/legacy), CBC (deprecated/legacy)
   4. Key size(s)
4. Decryption is considered successful if the first 4 bytes of the decrypted data contain the ASCII string "TRUE", and if the CRC-32 checksum of the last 256 bytes of the decrypted data (volume header) matches the value located at byte #8 of the decrypted data (this value is unknown to an adversary because it is encrypted ***8211; see the section Header Key Derivation, Salt, and Iteration Count). If these conditions are not met, the process continues from (3) again, but this time, instead of the data read in (1), the data read in (2) are used (i.e., possible hidden volume header). If the conditions are not met again, mounting is terminated (wrong password, corrupted volume, or not a TrueCrypt volume).