I was a little surprised to find out this morning that this was already public.
The cryptography audit for Truecrypt is going to be run much differently than the software security audit. We'll have more to say about it next week, but for now: it's something in between a "public bug bounty" and a "summer of code" program. Me, Nate, and several other crypto people will be working not as consultants to the projects, but as "mentors" (I hate that term) leading developers interested in cryptography.
As to why the audit is proceeding: it's obvious, at least to me. Tens of thousands of people will continue to use Truecrypt no matter what we do, and if nobody takes a serious and organized look at its cryptography, the circumstances behind the conclusion of its development will create yet another Internet Crypto Urban Legend.
The cryptography audit for Truecrypt is going to be run much differently than the software security audit. We'll have more to say about it next week, but for now: it's something in between a "public bug bounty" and a "summer of code" program. Me, Nate, and several other crypto people will be working not as consultants to the projects, but as "mentors" (I hate that term) leading developers interested in cryptography.
As to why the audit is proceeding: it's obvious, at least to me. Tens of thousands of people will continue to use Truecrypt no matter what we do, and if nobody takes a serious and organized look at its cryptography, the circumstances behind the conclusion of its development will create yet another Internet Crypto Urban Legend.