Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix default algos #1082

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Conversation

wendig0x
Copy link
Contributor

Removed the default values for the algorithms. The default values attack first.

https://blog.elcomsoft.com/2021/06/breaking-veracrypt-obtaining-and-extracting-on-the-fly-encryption-keys/

@idrassi
Copy link
Member

idrassi commented May 31, 2023

Thank you.
I understand the idea behind this change but the choice of the algorithm can have impact on usability depending on the usage context (for example AES/SHA512 is the fastest combinaition and this is what most users look for). I see this feature as more towards security-focus people. Probably we should add a setting to enable randomization of algorithms during encryption process.

Concering the implementation, I would not use CRT srand/rand. I prefer to use more secure alternative (like RtlGenRandom)

@wendig0x
Copy link
Contributor Author

wendig0x commented Jun 2, 2023

This change leaves the choice of algorithm to the user. Many people just don't make any choice, and make it easy for attackers to attack. As for RtlGenRandom - I think in this case, srand does not affect security.

@wendig0x
Copy link
Contributor Author

@idrassi

I found another confirmation that attackers are using default values to crack VeraCrypt:
https://www.forensicfocus.com/articles/how-to-efficiently-decrypt-truecrypt-veracrypt-encryption-using-passware/

I think I've found a compromise solution: maybe just add a text warning that the default values used help the attacker?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants