The Polder Consortium Computer Security Response Community (CompSec RC) has published a report <https://docs.google.com/a/sil.org/document/d/13ZQbnYR9DkYgj8xcJA4wIlsDjIZbFg9Efu514K77aQs/edit> that provides analysis of the situation and guidance for IT decision makers.
The IT Security community was bewildered by the May 28, 2014 announcement on the TrueCrypt website declaring “WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues”. The website furthermore directs users to migrate data from disks, volumes and containers previously encrypted with TrueCrypt to “encrypted disks or virtual disk images supported on your platform”. The situation is made much more difficult by the fact that the TrueCrypt developers have maintained anonymity over the ten year life-cycle of this product. Thus there have been no interviews with the developers and as a result, a lot of conjecture has arisen regarding the mysterious manner in which they terminated the project. Based on our analysis of this situation <https://docs.google.com/a/sil.org/document/d/13ZQbnYR9DkYgj8xcJA4wIlsDjIZbFg9Efu514K77aQs/edit> we are recommending the following action steps: 1. It is considered safe (with caveats <https://docs.google.com/a/sil.org/document/d/13ZQbnYR9DkYgj8xcJA4wIlsDjIZbFg9Efu514K77aQs/edit#heading=h.jaue6g3om9xi>) to continue using the latest working version (7.1a) but only for the short-term, i.e., the next 6 months. Please do not take this as an endorsement that users should continue using TrueCrypt! 2. TrueCrypt is no longer a viable option for long-term strategic initiatives. We highly recommend organizations develop a migration plan for transitioning away from TrueCrypt. We may have more specific recommendations at a later date but for guidance see the full report <https://docs.google.com/a/sil.org/document/d/13ZQbnYR9DkYgj8xcJA4wIlsDjIZbFg9Efu514K77aQs/edit> . 3. We further recommend that users no longer download TrueCrypt or install it on client machines. In particular we recommend against downloading the latest TrueCrypt version 7.2 because there is some (unverified) risk that the TrueCrypt 7.2 install files are compromised. Individuals having TrueCrypt encrypted volumes but not having TrueCrypt already installed should download version 7.1a from GRC’s TrueCryptⓇ Final Release Repository for the purpose of accessing those files and migrating them to a secure encryption platform. See the full report here CS-RC Report - TrueCrypt, June 2014 <https://docs.google.com/a/sil.org/document/d/13ZQbnYR9DkYgj8xcJA4wIlsDjIZbFg9Efu514K77aQs/edit> . --Steve Moitozo <http://www.sil.org/biography/steve-moitozo> Director of SIL Global Technology & Information Services <http://goo.gl/UdLvQZ> [image: 2014 SIL Logo] <http://www.sil.org/>
