A second look at VeraCrypt, an unofficial TrueCrypt successor

When the TrueCrypt developers announced that they would quit developing the encryption software because of it not being secure, many users of the software did not know what to make of the announcement.

What became clear quickly was that TrueCrypt development would not continue in this form and that others would have to take over for development to continue.

A couple of projects were announced shortly after the dust settled and one of them was VeraCrypt by IDRIX. It was not the only project, Ciphershed is another, but one of the first to produce a program that users could download and make use of to encrypt their hard drives.

While based on TrueCrypt, the format used by VeraCrypt is not compatible with that of TrueCrypt. Users who want to move from TrueCrypt need to decrypt their drives and partitions first before they encrypt them again using VeraCrypt.

The most recent stable version of VeraCrypt, version 1.0e was released on September 4, 2014. It corrected security vulnerabilities found by the Open Crypto Audit Project. The project's goal is to audit TrueCrypt thoroughly to make sure it is secure.

In addition to that, it also fixed security issues detected by code analysis and fixed several minor bugs.

A beta version of the upcoming VeraCrypt 1.0f was released on October 26, 2014. The version introduces a number of changes affecting all supported operating systems and changes that only affect select systems.

All operating systems benefit from support for SHA-256 for volume encryption, SHA-512 as the default key derivation algorithm and a change of the order of preference of derivation algorithms to SHA-512 --> Whirlpool --> Sha-256 --> RIPEMD160.

A vulnerability in the bootloader was fixed on Windows and various optimizations were made to it as well. The developers added support for SHA-256 to the system boot encryption option and fixed a ShellExecute security issue as well.

Linux and Mac OS X users benefit from support for hard drives with sector sizes larger than 512. Linux on top of that got support for NTFS formatting of volumes.

It is not clear yet when the final VeraCRypt 1.0f version is released but if the developers keep the three month development cycle it will be release in December.

VeraCrypt development is progressing nicely with new versions being released regularly by the developers. The final verdict on TrueCrypt's security is still out as the second part of the audit has not been completed yet. Judging from the past, it is likely that IDRIX will resolve the majority of issues discovered during the second part of the audit quickly since they have done so before for the first part.