Public/VeraCrypt
1
0
Fork 0
mirror of https://github.com/veracrypt/VeraCrypt.git synced 2026-06-10 06:46:59 -05:00
Code Activity

Document fixed Argon2id header key size

Browse Source 
Argon2id includes the requested output length in its computation, so deriving 192 bytes and using a prefix is not equivalent to deriving only the selected cipher's key material length. This differs from PBKDF2, where the prefix property made this detail invisible.

VeraCrypt derives the maximum header key material currently needed by the supported cipher/cascade set, which is 192 bytes, and then uses the required prefix for the selected encryption algorithm. For AES-XTS this means the first 64 bytes of the 192-byte Argon2id output are used.

Make this design rule explicit in code and documentation by introducing ARGON2_HEADER_KEYDATA_SIZE instead of relying implicitly on GetMaxPkcs5OutSize. If a future cipher or cascade requires more than 192 bytes, that must be handled as an explicit format/design change.

Document the 192-byte Argon2id header KDF output requirement so third-party implementations derive the same header key material.

References: https://github.com/veracrypt/VeraCrypt/issues/1614
This commit is contained in:
Mounir IDRASSI
2026-05-21 17:19:23 +09:00
parent c4acb6a0be
commit c3ce2db9ac
12 changed files with 81 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Common/Crypto.c
+2 -2
View File
@@ -801,7 +801,8 @@ int EAGetLargestKeyForMode (int mode)
return key;
}
// Returns the maximum number of bytes necessary to be generated by the PBKDF2 (PKCS #5)
// Returns the maximum number of bytes necessary to be generated by PBKDF2 (PKCS #5).
// Argon2id header key material uses the fixed ARGON2_HEADER_KEYDATA_SIZE value.
int GetMaxPkcs5OutSize (void)
{
int size = 32;
@@ -1488,4 +1489,3 @@ void VcUnprotectKeys (PCRYPTO_INFO pCryptoInfo, uint64 encID)
#endif
#endif
src/Common/Crypto.h
+6
View File
@@ -44,6 +44,12 @@ extern "C" {
// Size of the volume header area containing concatenated master key(s) and secondary key(s) (XTS mode)
#define MASTER_KEYDATA_SIZE 256
#ifndef VC_DCS_DISABLE_ARGON2
// VeraCrypt Argon2id header key material size, in bytes, for the current volume format.
// This is intentionally fixed for compatibility and must not depend on GetMaxPkcs5OutSize().
#define ARGON2_HEADER_KEYDATA_SIZE 192
#endif
// The first PRF to try when mounting
#define FIRST_PRF_ID 1
src/Common/Dlgcode.c
+1 -1
View File
@@ -6570,7 +6570,7 @@ static BOOL PerformBenchmark(HWND hBenchDlg, HWND hwndDlg)
case ARGON2:
/* test with ARGON2 used as the PRF */
if (derive_key_argon2 ((const unsigned char*) "passphrase-1234567890", 21, (const unsigned char*)tmp_salt, 64, iterations, memoryCost, dk, MASTER_KEYDATA_SIZE, NULL) != 0)
if (derive_key_argon2 ((const unsigned char*) "passphrase-1234567890", 21, (const unsigned char*)tmp_salt, 64, iterations, memoryCost, dk, ARGON2_HEADER_KEYDATA_SIZE, NULL) != 0)
goto key_derivation_error;
break;
}
src/Common/EncryptionThreadPool.c
+1 -1
View File
@@ -277,7 +277,7 @@ static TC_THREAD_PROC EncryptionThreadProc (void *threadArg)
case ARGON2:
derivationResult = derive_key_argon2(workItem->KeyDerivation.Password, workItem->KeyDerivation.PasswordLength, workItem->KeyDerivation.Salt, PKCS5_SALT_SIZE,
workItem->KeyDerivation.IterationCount, workItem->KeyDerivation.Memorycost, workItem->KeyDerivation.DerivedKey, GetMaxPkcs5OutSize(), workItem->KeyDerivation.pAbortKeyDerivation);
workItem->KeyDerivation.IterationCount, workItem->KeyDerivation.Memorycost, workItem->KeyDerivation.DerivedKey, ARGON2_HEADER_KEYDATA_SIZE, workItem->KeyDerivation.pAbortKeyDerivation);
break;
default:
src/Common/Volumes.c
+17 -2
View File
@@ -448,7 +448,7 @@ KeyReady: ;
case ARGON2:
{
int derivationResult = derive_key_argon2(keyInfo->userKey, keyInfo->keyLength, keyInfo->salt,
PKCS5_SALT_SIZE, keyInfo->noIterations, keyInfo->memoryCost, dk, GetMaxPkcs5OutSize(), &abortKeyDerivation);
PKCS5_SALT_SIZE, keyInfo->noIterations, keyInfo->memoryCost, dk, ARGON2_HEADER_KEYDATA_SIZE, &abortKeyDerivation);
if (derivationResult != 0)
{
if (selected_pkcs5_prf == 0)
@@ -492,6 +492,12 @@ KeyReady: ;
if (!EAIsModeSupported (cryptoInfo->ea, cryptoInfo->mode))
continue; // This encryption algorithm has never been available with this mode of operation
#ifndef VC_DCS_DISABLE_ARGON2
/* Only XTS mode reaches this point; both XTS keys must fit in the fixed Argon2id output. */
if (pkcs5_prf == ARGON2 && EAGetKeySize (cryptoInfo->ea) * 2 > ARGON2_HEADER_KEYDATA_SIZE)
continue;
#endif
blockSize = CipherGetBlockSize (EAGetFirstCipher (cryptoInfo->ea));
status = EAInit (cryptoInfo->ea, dk + primaryKeyOffset, cryptoInfo->ks);
@@ -1074,6 +1080,15 @@ int CreateVolumeHeaderInMemory (HWND hwndDlg, BOOL bBoot, unsigned char *header,
// User selected encryption algorithm
cryptoInfo->ea = ea;
#ifndef VC_DCS_DISABLE_ARGON2
if (pkcs5_prf == ARGON2 && EAGetKeySize (ea) * 2 > ARGON2_HEADER_KEYDATA_SIZE)
{
crypto_close (cryptoInfo);
retVal = ERR_PARAMETER_INCORRECT;
goto err;
}
#endif
// User selected PRF
cryptoInfo->pkcs5 = pkcs5_prf;
cryptoInfo->noIterations = keyInfo.noIterations;
@@ -1130,7 +1145,7 @@ int CreateVolumeHeaderInMemory (HWND hwndDlg, BOOL bBoot, unsigned char *header,
case ARGON2:
{
int derivationResult = derive_key_argon2(keyInfo.userKey, keyInfo.keyLength, keyInfo.salt,
PKCS5_SALT_SIZE, keyInfo.noIterations, keyInfo.memoryCost, dk, GetMaxPkcs5OutSize(), NULL);
PKCS5_SALT_SIZE, keyInfo.noIterations, keyInfo.memoryCost, dk, ARGON2_HEADER_KEYDATA_SIZE, NULL);
if (derivationResult != 0)
{
crypto_close (cryptoInfo);