Skip to content

Commit 1267cab

Browse files
mbrozmbroz
committed
tcrypt: Support Argon2id PBKDF introduced in VeraCrypt 1.26.27.
It uses Argon2id only, with maximal memory cost 1024 MiB. Parallel cost is always 1. Default parameters (no PIM) is 416 MiB, 6 iterations (same as PIM 12). In PIM mode, iterations and memory costs are calculated according to the specific formula. Memory cost is always limited as above.
1 parent e657349 commit 1267cab

1 file changed

Lines changed: 55 additions & 27 deletions

File tree

‎lib/tcrypt/tcrypt.c‎

Lines changed: 55 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -22,25 +22,28 @@ static const struct {
2222
const char *name;
2323
const char *hash;
2424
unsigned int iterations;
25+
uint32_t parallel_cost;
26+
uint32_t memory_cost;
2527
uint32_t veracrypt_pim_const;
2628
uint32_t veracrypt_pim_mult;
2729
} tcrypt_kdf[] = {
28-
{ false, false, "pbkdf2", "ripemd160", 2000, 0, 0 },
29-
{ false, false, "pbkdf2", "ripemd160", 1000, 0, 0 },
30-
{ false, false, "pbkdf2", "sha512", 1000, 0, 0 },
31-
{ false, false, "pbkdf2", "whirlpool", 1000, 0, 0 },
32-
{ true, false, "pbkdf2", "sha1", 2000, 0, 0 },
33-
{ false, true, "pbkdf2", "sha512", 500000, 15000, 1000 },
34-
{ false, true, "pbkdf2", "whirlpool", 500000, 15000, 1000 },
35-
{ false, true, "pbkdf2", "sha256", 500000, 15000, 1000 }, // VeraCrypt 1.0f
36-
{ false, true, "pbkdf2", "sha256", 200000, 0, 2048 }, // boot only
37-
{ false, true, "pbkdf2", "blake2s-256", 500000, 15000, 1000 }, // VeraCrypt 1.26.2
38-
{ false, true, "pbkdf2", "blake2s-256", 200000, 0, 2048 }, // boot only
39-
{ false, true, "pbkdf2", "ripemd160", 655331, 15000, 1000 },
40-
{ false, true, "pbkdf2", "ripemd160", 327661, 0, 2048 }, // boot only
41-
{ false, true, "pbkdf2", "stribog512",500000, 15000, 1000 },
42-
// { false, true, "pbkdf2", "stribog512",200000, 0, 2048 }, // boot only
43-
{ false, false, NULL, NULL, 0, 0, 0 }
30+
{ false, false, "pbkdf2", "ripemd160", 2000, 0, 0, 0, 0 },
31+
{ false, false, "pbkdf2", "ripemd160", 1000, 0, 0, 0, 0 },
32+
{ false, false, "pbkdf2", "sha512", 1000, 0, 0, 0, 0 },
33+
{ false, false, "pbkdf2", "whirlpool", 1000, 0, 0, 0, 0 },
34+
{ true, false, "pbkdf2", "sha1", 2000, 0, 0, 0, 0 },
35+
{ false, true, "pbkdf2", "sha512", 500000, 0, 0, 15000, 1000 },
36+
{ false, true, "pbkdf2", "whirlpool", 500000, 0, 0, 15000, 1000 },
37+
{ false, true, "pbkdf2", "sha256", 500000, 0, 0, 15000, 1000 }, // VeraCrypt 1.0f
38+
{ false, true, "pbkdf2", "sha256", 200000, 0, 0, 0, 2048 }, // boot only
39+
{ false, true, "argon2id", NULL, 6, 1, 425984, 0, 0 }, // VeraCrypt 1.26.27
40+
{ false, true, "pbkdf2", "blake2s-256", 500000, 0, 0, 15000, 1000 }, // VeraCrypt 1.26.2
41+
{ false, true, "pbkdf2", "blake2s-256", 200000, 0, 0, 0, 2048 }, // boot only
42+
{ false, true, "pbkdf2", "ripemd160", 655331, 0, 0, 15000, 1000 },
43+
{ false, true, "pbkdf2", "ripemd160", 327661, 0, 0, 0, 2048 }, // boot only
44+
{ false, true, "pbkdf2", "stribog512", 500000, 0, 0, 15000, 1000 },
45+
// { false, true, "pbkdf2", "stribog512", 200000, 0, 0, 0, 2048 }, // boot only
46+
{ false, false, NULL, NULL, 0, 0, 0, 0, 0 }
4447
};
4548

4649
struct tcrypt_alg {
@@ -239,7 +242,8 @@ static int TCRYPT_hdr_from_disk(struct crypt_device *cd,
239242
/* Set params */
240243
params->passphrase = NULL;
241244
params->passphrase_size = 0;
242-
params->hash_name = tcrypt_kdf[kdf_index].hash;
245+
/* For Argon2, overload hash_name */
246+
params->hash_name = tcrypt_kdf[kdf_index].hash ?: tcrypt_kdf[kdf_index].name;
243247
params->key_size = tcrypt_cipher[cipher_index].chain_key_size;
244248
params->cipher = tcrypt_cipher[cipher_index].long_name;
245249
params->mode = tcrypt_cipher[cipher_index].mode;
@@ -520,7 +524,8 @@ static int TCRYPT_init_hdr(struct crypt_device *cd,
520524
unsigned char *pwd = NULL;
521525
size_t passphrase_size, max_passphrase_size;
522526
char *key = NULL;
523-
unsigned int i, iterations;
527+
unsigned int i;
528+
uint32_t iterations, memory;
524529
int r = -EPERM, keyfiles_pool_length;
525530

526531
pwd = crypt_safe_alloc(VCRYPT_KEY_POOL_LEN);
@@ -563,7 +568,9 @@ static int TCRYPT_init_hdr(struct crypt_device *cd,
563568
pwd[i] += params->passphrase[i];
564569

565570
for (i = 0; tcrypt_kdf[i].name; i++) {
566-
if (params->hash_name && !strstr(tcrypt_kdf[i].hash, params->hash_name))
571+
if (params->hash_name && tcrypt_kdf[i].hash && !strstr(tcrypt_kdf[i].hash, params->hash_name))
572+
continue;
573+
if (params->hash_name && !tcrypt_kdf[i].hash && !strstr(tcrypt_kdf[i].name, params->hash_name))
567574
continue;
568575
if (!(params->flags & CRYPT_TCRYPT_LEGACY_MODES) && tcrypt_kdf[i].legacy)
569576
continue;
@@ -574,19 +581,36 @@ static int TCRYPT_init_hdr(struct crypt_device *cd,
574581
if (!tcrypt_kdf[i].veracrypt)
575582
continue;
576583
/* adjust iterations to given PIM cmdline parameter */
577-
iterations = tcrypt_kdf[i].veracrypt_pim_const +
578-
(tcrypt_kdf[i].veracrypt_pim_mult * params->veracrypt_pim);
579-
} else
584+
if (!strcmp(tcrypt_kdf[i].name, "argon2id")) {
585+
if (params->veracrypt_pim <= 31) {
586+
iterations = (params->veracrypt_pim - 1) / 3 + 3;
587+
memory = 1024 * (64 + (params->veracrypt_pim - 1) * 32);
588+
} else{
589+
iterations = params->veracrypt_pim - 18;
590+
memory = 1024 * 1024;
591+
}
592+
} else {
593+
iterations = tcrypt_kdf[i].veracrypt_pim_const +
594+
(tcrypt_kdf[i].veracrypt_pim_mult * params->veracrypt_pim);
595+
memory = 0;
596+
}
597+
} else {
580598
iterations = tcrypt_kdf[i].iterations;
599+
memory = tcrypt_kdf[i].memory_cost;
600+
}
581601
/* Derive header key */
582-
log_dbg(cd, "TCRYPT: trying KDF: %s-%s-%d%s.",
583-
tcrypt_kdf[i].name, tcrypt_kdf[i].hash, tcrypt_kdf[i].iterations,
584-
params->veracrypt_pim && tcrypt_kdf[i].veracrypt ? "-PIM" : "");
602+
if (!strcmp(tcrypt_kdf[i].name, "argon2id"))
603+
log_dbg(cd, "TCRYPT: trying KDF: %s%s.", tcrypt_kdf[i].name,
604+
params->veracrypt_pim && tcrypt_kdf[i].veracrypt ? "-PIM" : "");
605+
else
606+
log_dbg(cd, "TCRYPT: trying KDF: %s-%s-%d%s.",
607+
tcrypt_kdf[i].name, tcrypt_kdf[i].hash, tcrypt_kdf[i].iterations,
608+
params->veracrypt_pim && tcrypt_kdf[i].veracrypt ? "-PIM" : "");
585609
r = crypt_pbkdf(tcrypt_kdf[i].name, tcrypt_kdf[i].hash,
586610
(char*)pwd, passphrase_size,
587611
hdr->salt, TCRYPT_HDR_SALT_LEN,
588612
key, TCRYPT_HDR_KEY_LEN,
589-
iterations, 0, 0);
613+
iterations, memory, tcrypt_kdf[i].parallel_cost);
590614
if (r < 0) {
591615
log_verbose(cd, _("PBKDF2 hash algorithm %s not available, skipping."),
592616
tcrypt_kdf[i].hash);
@@ -1180,7 +1204,11 @@ int TCRYPT_dump(struct crypt_device *cd,
11801204
log_std(cd, "Volume size:\t%" PRIu64 " [bytes]\n", hdr->d.volume_size);
11811205
if (hdr->d.hidden_volume_size)
11821206
log_std(cd, "Hidden size:\t%" PRIu64 " [bytes]\n", hdr->d.hidden_volume_size);
1183-
log_std(cd, "PBKDF2 hash:\t%s\n", params->hash_name);
1207+
if (strcmp(params->hash_name, "argon2id")) {
1208+
log_std(cd, "PBKDF:\t\tPBKDF2\n");
1209+
log_std(cd, "PBKDF2 hash:\t%s\n", params->hash_name);
1210+
} else
1211+
log_std(cd, "PBKDF:\t\tArgon2id\n");
11841212
}
11851213
log_std(cd, "Cipher chain:\t%s\n", params->cipher);
11861214
log_std(cd, "Cipher mode:\t%s\n", params->mode);

0 commit comments

Comments
 (0)