VeraCrypt is afork of the discontinuedTrueCrypt project.[10] It was initially released on 22 June 2013. Many security improvements have been implemented and concerns within the TrueCrypt codeaudits have been addressed. VeraCrypt includes optimizations to the original cryptographic hash functions and ciphers, which boost performance on modernCPUs.
VeraCrypt'sblock cipher mode of operation isXTS.[15] It generates the header key and the secondary header key (XTS mode) usingPBKDF2 with a 512-bitsalt. By default they go through 200,000 or 500,000 iterations, depending on the underlying hash function used and whether it is system or non-system encryption.[16] The user can customize it to lower these numbers to as low as 2,048 and 16,000 respectively.[16]
The VeraCrypt development team considered the TrueCrypt storage format too vulnerable to aNational Security Agency (NSA) attack, so it created a new format incompatible with that of TrueCrypt. VeraCrypt versions prior to 1.26.5 are capable of opening and converting volumes in the TrueCrypt format.[17][18] Since ver. 1.26.5 TrueCrypt compatibility is dropped.[19]
An independent security audit of TrueCrypt released 29 September 2015 found TrueCrypt includes two vulnerabilities in the Windows installation driver allowing an attackerarbitrary code execution andprivilege escalation viaDLL hijacking.[20] This was fixed in VeraCrypt in January 2016.[21]
While TrueCrypt uses 1,000 iterations of thePBKDF2-RIPEMD-160 algorithm for system partitions, VeraCrypt uses either 200,000 iterations (SHA-256,BLAKE2s-256,Streebog) or 500,000 iterations (SHA-512,Whirlpool) by default (which is customizable by user to be as low as 2,048 and 16,000 respectively).[16] For standard containers and non-system partitions, VeraCrypt uses 500,000 iterations by default regardless of the hashing algorithm chosen (which is customizable by user to be as low as 16,000).[16] While these default settings make VeraCrypt slower at opening encrypted partitions, it also makes password-guessing attacks slower.[22]
Additionally, since version 1.12, a new feature called "Personal Iterations Multiplier" (PIM) provides a parameter whose value is used to control the number of iterations used by the header key derivation function, thereby makingbrute-force attacks potentially even more difficult. VeraCrypt out of the box uses a reasonable PIM value to improve security,[23] but users can provide a higher value to enhance security. The primary downside of this feature is that it makes the process of opening encrypted archives even slower.[23][24][25][26]
A vulnerability in thebootloader was fixed on Windows and various optimizations were made as well. The developers added support for SHA-256 to the system boot encryption option and also fixed a ShellExecute security issue.Linux andmacOS users benefit from support for hard drives with sector sizes larger than 512. Linux also received support for theNTFS formatting of volumes.
Unicode passwords are supported on all operating systems since version 1.17 (except for system encryption on Windows).[17]
VeraCrypt added the capability to boot system partitions usingUEFI in version 1.18a.[17]
Option to enable/disable support for theTRIM command for both system and non-system drives was added in version 1.22.[17]
QuarksLab conducted an audit of version 1.18 on behalf of the Open Source Technology Improvement Fund (OSTIF), which took 32man-days. The auditor published the results on 17 October 2016.[17][27][28] On the same day, IDRIX released version 1.19, which resolved major vulnerabilities identified in the audit.[29]
There are several kinds of attacks to which all software-based disk encryption is vulnerable. As with TrueCrypt, the VeraCrypt documentation instructs users to follow various security precautions to mitigate these attacks,[32][33] several of which are detailed below.
VeraCrypt stores its keys inRAM; on some personal computersDRAM will maintain its contents for several seconds after power is cut (or longer if the temperature is lowered). Even if there is some degradation in the memory contents, various algorithms may be able to recover the keys. This method, known as acold boot attack (which would apply in particular to a notebook computer obtained while in power-on, suspended, or screen-locked mode), was successfully used to attack a file system protected byTrueCrypt versions 4.3a and 5.0a in 2008.[34] With version 1.24, VeraCrypt added the option of encrypting the in-RAMkeys and passwords onx64 editions of Windows, with a CPU overhead of less than 10%, and the option of erasing all encryption keys from memory when a new device is connected.[17]
VeraCrypt documentation states that VeraCrypt is unable to secure data on a computer if an attacker physically accessed it and VeraCrypt is then used on the compromised computer by the user again. This does not affect the common case of a stolen, lost, or confiscated computer.[35] The attacker having physical access to a computer can, for example, install a hardware or a softwarekeylogger, abus-mastering device capturingmemory or install any other malicioushardware orsoftware, allowing the attacker to capture unencrypted data (including encryption keys and passwords) or to decrypt encrypted data using captured passwords or encryption keys. Therefore, physical security is a basic premise of a secure system.[36]
Some kinds of malware are designed tolog keystrokes, including typed passwords, that may then be sent to the attacker over the Internet or saved to an unencrypted local drive from which the attacker might be able to read it later, when they gain physical access to the computer.[37]
VeraCrypt does not take advantage of Trusted Platform Module (TPM). VeraCrypt FAQ repeats the negative opinion of the original TrueCrypt developers verbatim.[38] The TrueCrypt developers were of the opinion that the exclusive purpose of the TPM is "to protect against attacks that require the attacker to have administrator privileges, or physical access to the computer". The attacker who has physical or administrative access to a computer can circumvent TPM, e.g., by installing a hardwarekeystroke logger, by resetting TPM, or by capturing memory contents and retrieving TPM-issued keys. The condemning text goes so far as to claim that TPM is entirely redundant.[39]
It is true that after achieving either unrestricted physical access or administrative privileges, it is only a matter of time before other security measures in place are bypassed.[40][41] However, stopping an attacker in possession of administrative privileges has never been one of the goals of TPM. (SeeTrusted Platform Module § Uses for details.) TPM might, however, reduce the success rate of thecold boot attack described above.[42][43][44][45][46] TPM is also known to be susceptible to SPI attacks.[47]
As with its predecessorTrueCrypt, VeraCrypt supportsplausible deniability[48] by allowing a single "hidden volume" to be created within another volume.[49] The Windows versions of VeraCrypt can create and run a hidden encrypted operating system whoseexistence may be denied.[50] The VeraCrypt documentation lists ways in which the hidden volume deniability features may be compromised (e.g., by third-party software which may leak information through temporary files or via thumbnails) and possible ways to avoid this.[32]
VeraCrypt supportsparallelized[51]: 63 encryption formulti-core systems. On Microsoft Windows,pipelined read and write operations (a form of asynchronous processing)[51]: 63 to reduce the performance hit of encryption and decryption. On processors supporting theAES-NI instruction set, VeraCrypt supports hardware-accelerated AES to further improve performance.[51]: 64 On 64-bit CPUs VeraCrypt uses optimizedassembly implementation of Twofish, Serpent, and Camellia.[17]
VeraCrypt wasforked from the since-discontinuedTrueCrypt project in 2013,[10] and originally contained mostly TrueCrypt code released under the TrueCrypt License 3.0. In the years since, more and more of VeraCrypt's code has been rewritten and released under the permissiveApache License 2.0.
The TrueCrypt license is generally considered to besource-available but notfree and open source. The Apache license is universally considered to be free and open source. The mixed VeraCrypt license is widely but not universally considered to be free and open source.
On 28 May 2014 TrueCryptceased development under unusual circumstances,[52][53][54] and there exists no way to contact the former developers.
VeraCrypt is considered to be free and open source by:
At least one member of theOpen Source Initiative (OSI). The director[68] expressed concern about an older version of the TrueCrypt license, but the OSI itself has not published a determination regarding either TrueCrypt or VeraCrypt.
InUnited States v Burns (M.D.N.C), the defendant had three hard drives, the first being a system partition which was later found to contain caches of deletedchild pornography and manuals for how to use VeraCrypt, with the second being encrypted, and the third having miscellaneous music files. Even though the defendant admitted to having child pornography on his second hard drive, he refused to give the password to the authorities. Despite searching for clues of previously used passwords on the first drive, and inquiries to the FBI about any weaknesses to the VeraCrypt software that could be used to access the drive partition, and brute-forcing the partition with thealphanumeric character set as potential passwords, the partition could not be accessed. Due to the defendant confessing to having child pornography on the encrypted drive, the prosecution applied to force the defendant to give away the password under the foregone conclusion doctrine in theAll Writs Act.[69]
In a search of a Californian defendant's apartment for accessing child pornography, a VeraCrypt drive that was over 900gigabytes was found as an external hard drive. TheFBI was called to assist local law enforcement, but the FBI claimed to not have found a weakness in the VeraCrypt software. The FBI also denied having a backdoor within the VeraCrypt software. It was later found that another suspect had educated the defendant into using encryption to hide his photos and videos of child pornography. Because the defendant had admitted to having child pornography on the drive as a backup anyways and chat logs relating to the other suspect educating the defendant on how to use VeraCrypt, the foregone conclusion doctrine was used again.[70]
