TrueCrypt is created with on-the-fly encryption in 32-/64-bit Microsoft Windows NT5 and later (GUI interface), Mac OS X, Linux. It allows creating an encrypted virtual logical disk, which is stored as a file.
TrueCrypt can fully encrypt partitions of a hard drive or other storage media (floppy disk, USB flash memory). All data in a TrueCrypt volume is fully encrypted, including directory names and file names.
The created and saved TrueCrypt volume is analogous to an ordinary logical disk; you can work with it using simple utilities for defragmentation and file system checking.
TrueCrypt supports encryption algorithms:
Twofish, Serpent, AES. Additionally, cascaded encryption with multiple ciphers is used, for example:
Serpent+AES+Twofish. All encryption algorithms operate in
XTS mode, which is much more secure than LRW and CBC used in previous versions.
The program allows selection of one of three hash functions: HMAC-Whirlpool, HMAC-RIPEMD160, and HMAC-SHA512 for generating encryption keys, salt, and header keys.
When accessing encrypted data, passwords (passphrase), one or more key files, or their combination are used. A key file is any accessible file on removable, network, or local drives (using the first 1048576 bytes) and one can generate their own key files.
One of the special features of TrueCrypt is a two-level system of plausible deniability regarding the existence of encrypted data, which is needed in case of forced disclosure of the user's password:
- Creating a hidden volume allows accepting a second password (and a set of key files) for the regular volume to access data that cannot be accessed with the main password; moreover, the hidden volume can have any file system and resides in the unused space sector of the main volume.
- TrueCrypt volumes cannot be identified (they are indistinguishable from ordinary data packets, since the file cannot be linked to the TrueCrypt program that created it).
Other functionality:
- Portability: TrueCrypt can be run without installation (NT administrator rights required).
- Supports creation of a dynamic encrypted file on NTFS drives. These TrueCrypt volumes expand in size as data accumulates up to the specified maximum size. However, using this feature slightly reduces security and system performance.
- Encryption of a physical system or logical drives in Microsoft Windows with pre-boot authentication (feature not built into all OS editions).
- It is possible to change the volume's key files and password without losing encrypted data.
- Backup and restoration of the volume header (1,024 bytes).
- Used to restore headers of damaged files to mount the volume in case of hardware-level errors that caused the header corruption.
- Restoring the previous header also resets to the volume password that was valid for the previous header.
- Assignment of hotkeys for mounting/dismounting volumes (including quick dismount with erasing the key from memory, clearing history, and closing the window), showing and hiding the TrueCrypt icon and window.
- TrueCrypt can be used on a PC with standard user rights (including creating and working with container files), however, the initial installation must be performed by an administrator.
