6 ms·

Without blindly claiming TC is backdoored, it does have an horrifically bad RNG which is housed in the application, and uses frantic wiggles of the mouse to gen

Without blindly claiming TC is backdoored, it does have an horrifically bad RNG which is housed in the application, and uses frantic wiggles of the mouse to generate seed values. Now depending on how much caffeine is in your system at the time, the values generated can differ quite substantially, ranging from super low (unsecure) entropy to 'fair game' entropy. Frankly I don't trust it one bit. If you consider how much room a mouse can potentially move within a typical desktop screen, the seed values are constrained within those params, always and forever.

dogma1138 11y ago
This really doesn't matter, the FBI nor anyone else will be dealing with decryption by building probabilistic modules on RNG generation using various given states and the average use of some one's mouse. TrueCrypt like many other FDE's has 2 keys, your Data Encryption Key which is generated by the software using random values, and your Key Encryption Key which is generated from a pass phrase and no random data since it has to be generated every time. The KEK is generated using a key derivation function most commonly PBKDF2, this is by far the easiest vector to attack because this vector is vulnerable to 2 fairly easy attacks. Brute force against the KDF which generated the KEK and brute force against the user which generated the pass phrase. Bad entropy or not the FBI will not be breaking AES anytime soon heck if AES can be broken atm with entropy as bad as some rolling a D20 the US government won't use it because you can be sure that some implementations of it in use by the USG have probably even shittier pseudo random number generators than that...