Note, the title is no longer accurate. There's an update at the end of the article, along with a download link:
> Shortly before we published this article the BSI has allowed to publish the Truecrypt documents. They can be downloaded from the Frag den Staat web page. Update from December 16th 2019, 13:22
They all have "geschwärzt" (blackened) in the file name, but it looks like only some author's name (and maybe working group name) have been removed -- I've scrolled through a few of these files, and didn't find anything else that might have been removed.
I'm not sure if the implication of the following is that sections of the report were withheld or that it was incomplete to begin with.
> However the report hints that more such flaws exist. Another chapter in the documents mentions, that several such off-by-one-errors were found, but due to a lack of a complete code analysis only examples can be shown. However even those examples are missing in the document - the following chapter only consists of a headline and has no content.
My understanding is that the auditors didn't have time to analyze all these errors, thus omitted them from the report already, but only pointing out the potential risk.
This AP7 (work package 7) document seemed the most relevant, although most of it reads like generic test results and conceptual stuff. Not sure why they would try to hold that back. A non-malicious view would be that they simply are a part of German bureaucracy and subsequently slow.
Non-Google translation of the summary (AP7, page 70) for those interested:
"5 Summary
This work package first describes the basic building blocks that are utilized to secure the start [boot?] process, as well as ones that might be necessary and helpful to realize hard dism encryption via full-disk-encryption .
Beyond that existing attacks are described and investigated if the solutions presented here mitigate against them or not.
In chapter 4 several possible solutions are presented, both online (meaning with network connectivity) as well as offline.
The most promising solutions use the new Trusted-Computing functionality based on a Trusted Platform Module (TPM) and a Boot of Trust (CRTM/SRTM/DRTM).
The most desirable solutions are the Secure Boot procedure from chapters 4.4 and 4.5. These do however require either the development of new hardware or need to be based on special hardware extensions, e.g. Intel's TXT technology.
A large-scale deployment in an existing, heterogenous area is therefore improbable.
At the moment solutions that combine Trusted Boot with the attestation functionality seem to be the most sensible. This solution can be combined with:
- Sealing: Storing a secret on the platform configuration.
- NVRAM: Storing a secret in an area of the Trusted Storage, inside the TPM, that is only readable/writable given a valid configuration.
- Attestation: Proof of platform integrity towards an external party.
As "external parties", multiple counterparts could be realized:
- Online, e.g. a central server.
- Offline: e.g. a smart card or a smart phone application that takes on the verification for the server.
All three variants (sealing, NVRAM, attestation) are reliant on the correctness of the PCRs."
The rest is potential use cases and an impact matrix of the attacks described in the document.
Which gives the "withhold" part of the story a strong push towards Hanlon's Razor, once the topic escalated to higher ranks the copyright ceased to be a hindrance.
Or more precisely, towards an organizational variety of Hanlon's Razor, where stupidity takes the form of the organizational failure mode of underlings not being authorized to do what would have been the right thing.
Curiously, a less colloquial formulation of Hanlon's Razor would replace stupidity with incompetence and this, when translated to German contains a hint of a precisely matching double entendre: in German, "Kompetenz" is used for two separate things. For being able to (like in English) and being authorized to. It's not a full double entendre because the negated form "Inkompetenz" is exclusive to the mental ability, just like the English counterpart, but what's a good aphorism without subtle extra layers?
> Shortly before we published this article the BSI has allowed to publish the Truecrypt documents. They can be downloaded from the Frag den Staat web page. Update from December 16th 2019, 13:22