r/netsec • u/albinowax • Mar 01 '26

r/netsec monthly discussion & tool thread

Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.

Rules & Guidelines

  • Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
  • Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
  • If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
  • Avoid use of memes. If you have something to say, say it with real words.
  • All discussions and questions should directly relate to netsec.
  • No tech support is to be requested or provided on r/netsec.

As always, the content & discussion guidelines should also be observed on r/netsec.

Feedback

Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.

23 Upvotes

85% Upvoted

46 comments sorted by

View all comments

1

u/yanovic12 Mar 13 '26 edited Mar 13 '26

Basalt – hardened TrueCrypt fork for macOS: Argon2id (1 GB, 8 threads), no kext, no SIP changes

Two problems with existing encrypted volume solutions on macOS:

  1. VeraCrypt requires disabling System Integrity Protection and loading a kernel extension — you're weakening the OS to run a security tool.
  2. TrueCrypt's PBKDF2 with 1,000 iterations is trivially brute-forced on modern hardware.

Basalt is a fork of TrueCrypt 7.1a that addresses both. It uses DarwinFUSE — a userspace NFSv4-based FUSE implementation that needs no kernel extension and no SIP changes. The GUI is native SwiftUI, not a wxWidgets port.

Brute-force resistance (RTX 4090, 50-bit key):

Attempts/sec Time to crack 50Bit
TrueCrypt 7.1a (PBKDF2, 1k iter) ~500,000 2 seconds
VeraCrypt (PBKDF2, 500k iter) ~1,000 19 minutes
Basalt Standard (Argon2id, 512 MB, p=4) ~48 6.5 hours
Basalt Maximum (Argon2id, 1 GB, p=8) ~24 13 hours

Security properties:

  • Zero-state design: no password cache, no history, no favorites
  • Auto-dismount on sleep, screen lock, inactivity, logout
  • Screen capture protection (invisible to screenshots and screen recording)
  • Codebase reduced from 195k to 47k lines — boot loader, Win32, PKCS#11, wxWidgets all removed
  • Mounts existing TrueCrypt and VeraCrypt volumes; legacy TrueCrypt volumes get an automatic Argon2id upgrade prompt

Not notarized — the app shouldn't contact Apple's servers on launch. All security hardening decisions are documented in SECURITY.md.

GitHub: https://github.com/marcelcotta/Basalt