Hacker News Reader

Comment by dryicerx | Hacker News Reader

I think a good strategy for anyone who may potentially have to go through this situation is to roll your own encryptor/encoder to combine several sets of data in to a single dataset, and having multiple keys associated with it. Depending on which key you use, you will get a different output. From the outside it will look like a simple way to disguise a already encrypted dataset.

A decoy in simple.

View on HN

I am not an expert in infosec but plausible deniability looks like a better strategy here.See http://www.truecrypt.org/docs/?s=plausible-deniability

Or maybe they should have a feature in TrueCrypt to allow "Fake Keys". You use your actual keys to unlock your data. You use fake keys to see pics of britney spears

Well if that feature is well know, that defeats the purpose. It will only work if you roll your own implementation of it (security through obscurity a bit).

How does it defeat the purpose? If an encrypted volume can have any number of stored "divisions," each with a different key, how can they prove that you're holding out on them once you've given them N keys? They know there's a possibility that you may have something extra hidden in the file, but that's not the same thing at all as knowing that there's definitely a file that you refuse to decrypt.

how can they prove that you're holding out on them

They'll bring in a forensic investigator, who will explain to the judge/jury that TrueCrypt has a feature designed to be used by criminals to subvert the judicial process. Then, he will present the results of his investigation, which will show your drive to be consistent with you using that "plausible deniability" thing. Then, he will introduce external evidence that says you almost certainly have, I don't know, kiddie porn -- look, we can prove he downloaded it, here are the ISP logs, and here are the 47 intercepted posts which use the same nickname he used for his online banking, and here is the previous complaint against him for lascivious comments made to a young lady on Facebook.

That will probably be good enough to convict you of possession. Circumstantial, yes, but so are most convictions.

I guess what would really be necessary is for all operating systems to build in plausible deniability by default. Then there wouldn't be a "circumstance" for the circumstantial evidence to pertain to, since there would be no way to have a computer without the possibility of there being something permanently hidden inside it.

As far as I'm aware, there's no external difference between a normal Truecrypt volume and one with a hidden volume. If you could find further evidence (like download records) you could convict them using that evidence, but I doubt you'd be able to convict anyone if all you had was a hunch that they were using a hidden volume.

I was thinking the same thing. It'd be really nice to get some of true crypt's functionality worked into the more popular Linux distributions. Full disk encryption is dead simple, but I'm not familiar with efforts to include more sophisticated crpyto functionality. Anyone care to enlighten me?

Reply on news.ycombinator.com