* Crypto: fix portable C code on big-endian CPUs
On big-endian CPUs (e.g. MIPS and PowerPC) the portable C code of
several algorithms assumes a little-endian host, so ciphertext, hashes
and derived keys are wrong and "veracrypt --text --test" fails:
- Twofish: the key-dependent S-box bytes are read back from 32-bit
words through a union, and blocks are loaded/stored as native words.
- Camellia: blocks and keys are always byte-swapped to big-endian.
- Kuznyechik: keys and blocks are loaded/stored as native 64-bit words
while the tables expect the little-endian interpretation.
- SHA-256/SHA-512: message words, length and digest are always
byte-swapped.
- BLAKE2s: the parameter block and message words are read as native
little-endian data. The parameter block is now built from its fields,
so it is right for any parameters, not only the ones VeraCrypt uses.
- Streebog: the existing big-endian code path is never enabled, and
BSWAP64 used by it is not defined (its buffer512 initializer also has
one pair of braces too many). Its add512() also differs from the
little-endian one, which drops a carry on purpose (existing volumes
depend on it); do the same limb arithmetic on big-endian.
- misc.h: the rotate-based bswap_32 (non-Linux, non-Apple, non-MSVC
builds) lacks outer parentheses, so "bswap_32(a) ^ b" is parsed
wrongly, and the fallback bswap_64 does not parenthesise its argument.
- PBKDF2: the block number is always byte-swapped.
Swap only where the host byte order differs from the data, and enable
the Streebog big-endian path. On big-endian hosts the message words,
keys and blocks of SHA-2, BLAKE2s, Twofish and Kuznyechik are read and
written byte-wise (new VcLoad*/VcStore* inline helpers in misc.h), so
these paths also work on misaligned buffers on strict-alignment CPUs.
On little-endian CPUs the code is unchanged: the object files of all
touched sources are byte-identical before and after this change
(checked on x86_64, aarch64 and mipsel). With it, all self-tests pass on
mips (big-endian) under qemu.
Signed-off-by: Ville Takio <ville+git@takio.fi>
* Volume: avoid unaligned 64-bit header and test vector accesses
The volume header (de)serialisation and TestXtsAES read and write 64-bit
fields through casted pointers into byte buffers at offsets that are
only 4-byte aligned (e.g. the header field at offset 12). CPUs that trap
on misaligned access without kernel fix-up (SPARC, MIPS64 on some
systems, qemu-user) then fail with SIGBUS in "veracrypt --test" and when
creating or opening any volume. Use memcpy instead, and have
DeserializeEntryAt check that the whole entry, not only its start, lies
inside the header.
The XTS code also accesses its local byte arrays (whitening values,
data unit number) through uint64 pointers; declare them 8-byte aligned
instead of relying on the compiler's stack layout.
Signed-off-by: Ville Takio <ville+git@takio.fi>
* Volume: test multi-block PBKDF2 output and the Streebog carry case
The PBKDF2 self-tests only check the first 4 bytes of each derivation,
so the block counter of the second and later output blocks is never
checked. Also compare the complete output of a 192-byte derivation for
every PRF, which covers the later blocks and how they are joined, and
hash a message whose block sum hits the carry case of Streebog's
add512(), which has to stay bit-compatible across CPUs. The message
buffer is 8-byte aligned, as the portable Streebog code reads it as
64-bit words. The expected values are those of the existing
little-endian code, and match independent implementations for all five
PRFs (Python hashlib/hmac, OpenSSL for Whirlpool, gostcrypto for
Streebog).
Signed-off-by: Ville Takio <ville+git@takio.fi>
---------
Signed-off-by: Ville Takio <ville+git@takio.fi>
Run display discovery asynchronously and bound batched disk-image inventory
queries. Filter auxiliary mounts by basename, filesystem and owner, and
keep unresolved candidates separate from verified volumes. Allow targeted
dismounts despite incomplete discovery while requiring complete results
for slot allocation and empty-inventory decisions.
Use nonthrowing GUI snapshots with monotonic freshness, completion events
and safe window lifetimes. Suspend inactivity decisions while the snapshot
is stale, without restarting idle timers: activity counters are cumulative
per volume instance. Refresh logout targets and retry only failed ones.
Show a progress dialog for interactive unmounts, but keep automatic ones
synchronous, so a quit or logout request that arrives meanwhile is handled
afterwards rather than refused. Guard core operations against reentry and
route wait-dialog requests only from worker threads, so a main-thread
message cannot wait for itself.
Bind teardown to captured mount and service identities, including process
start time. Report a service exit that cannot be confirmed after auxiliary
mount removal as a distinct error that keeps the original details. Such
volumes are not retried, and a multi-volume unmount reports all of them
together with any other failure or a declined prompt. Warn about it after
automatic unmounts and at quit, and keep the background application until
the warning is acknowledged. Keep rollback responsive, and let services
remove their auxiliary directories without probing mounted paths. Preserve
released /control compatibility and perform best-effort cleanup for older
services.
Reap bounded subprocesses as soon as their output ends. A child that
survives SIGKILL is reaped by a later call, which starts no new child until
then. Keep subjects and subprocess command, status and error output when
formatting exceptions for wrapping and logs. Clarify discovery and rollback
diagnostics. Fix the localization-dependent busy-volume regression
assertion and extend discovery, snapshot, process identity, cleanup, GUI
lifecycle, inactivity and teardown coverage.
The Blake2b hash class (BLAKE2b-512) was fully implemented but never
registered in Hash::GetAvailableAlgorithms(), so it was absent from the
Random Pool Enrichment, Keyfile Generator and Benchmark dialogs on
Linux/macOS. In particular, when Argon2 is selected as the volume PRF,
the RNG pool hash is set to BLAKE2b-512, but the Random Pool Enrichment
dialog could neither display nor pre-select it, diverging from Windows
which offers BLAKE2b-512 in the same dialog.
Register Blake2b after Streebog (matching the Crypto.c PRF order). Its
64-byte digest divides RNG_POOL_SIZE (320), so the HashMixPool size
constraint holds, and blake2b.o is always built in non-wolfCrypt builds.
Also make Pkcs5Kdf::GetAlgorithm(const Hash&) Argon2-aware by removing
the unconditional skip of the Argon2 KDF, so a BLAKE2b-512 hash now maps
to the Argon2 KDF instead of throwing.
Use plain objects for x86 intrinsic helper translation units only when building a local arm64-only macOS development binary. Universal macOS builds on Apple Silicon continue to use feature-specific suffix rules so the x86_64 slice keeps the required compiler flags.
Addresses the Apple Silicon Homebrew build failure reported in PR #1678. Credit to Audrius Buika for the original fix proposal and to Damian Rickard for confirming the issue on current master.
Extend the Unix encryption thread pool to run key-derivation work items and use it when mounting volumes without an explicitly selected KDF. This brings Linux/macOS header PRF autodetection closer to the Windows path while keeping selected-KDF mounts unchanged.
Fixes#1610.
Argon2id includes the requested output length in its computation, so deriving 192 bytes and using a prefix is not equivalent to deriving only the selected cipher's key material length. This differs from PBKDF2, where the prefix property made this detail invisible.
VeraCrypt derives the maximum header key material currently needed by the supported cipher/cascade set, which is 192 bytes, and then uses the required prefix for the selected encryption algorithm. For AES-XTS this means the first 64 bytes of the 192-byte Argon2id output are used.
Make this design rule explicit in code and documentation by introducing ARGON2_HEADER_KEYDATA_SIZE instead of relying implicitly on GetMaxPkcs5OutSize. If a future cipher or cascade requires more than 192 bytes, that must be handled as an explicit format/design change.
Document the 192-byte Argon2id header KDF output requirement so third-party implementations derive the same header key material.
References: https://github.com/veracrypt/VeraCrypt/issues/1614
Local macOS builds disable universal binaries. On Apple Silicon, that means
the regular objects are built for arm64 only, but Volume.make still selected
the macOS assembly bundle. Several of those assembly outputs are x86_64 only,
which makes ranlib reject Volume.a because it contains mixed cputypes.
Make local arm64 macOS builds use the existing arm64 crypto object path and
have the macOS build wrapper export CPU_ARCH/COMPILE_ASM consistently for
local builds.
The cascade order has been updated so that SM4 is applied after the other cipher(s) (e.g., Serpent). This change reflects standard cryptanalytic guidance, which shows that the overall strength of a cascade is limited by the first encryption stage. Given that SM4 uses a 128-bit key, its post-quantum brute-force resistance is lower than ciphers with a 256-bit key (such as Serpent). By placing SM4 last, we ensure that any potential weakness in SM4 cannot reduce the security margin provided by the stronger cipher.
If vulnerability detected, a warning message is displayed during mount or backup/restore header, and changing the password is disallowed since it will not change the master key.
* Add missing macOS requirement for 'make package'
We need packages for the last build step on macOS, update docs
to reflect the requirement.
* Add build instructions using homebrew
On macOS, we can use a package manager to easily install
dependencies. This simplifies onboarding and building Veracrypt.
* Add flag to use homebrew packages
When building, we can use prebuilt wxwidgets from homebrew to
simplify and speed up local building. We also put the package
behind a flag as it's optional during development.
* Skip signing for local builds
When building with homebrew, skip signing. This can be put behind
a flag to enable, if needed.
* Use system yasm on macOS if available
The binary in the repo is not universal (x86_64) and therefore
building fails on arm architecture if Rosetta is not installed.
Use local yasm if available.
* Build local arch only in development
When building via homebrew and locally, build only the local arch
which skips ASM for arm(Mx) for MacOS. This removes the need to
have rosetta installed for building.
* Fix compilation issue when COMPILE_ASM is undefined
Use a conditional check for COMPILE_ASM not being false instead of true.
This avoids passing the variable to other parts of the build script.
* Set SDK 12 as the minimum requirement and target
Align the requirement to SDK 12 in both the makefile and script,
and update the comment to remove confusion.
I chose to leave this on 12 to be on the side of err and support
as many building platforms as possible, when we can support.
The local script now also sets the target using the local sdk
version. This should improve the local development experience.
* Fix wrong architecture for macOS in x86 builds
We now build only the current arch for local development builds
in macOS. This change also fixes the x86 builds failing.
* Add instructions brew backed macOS local builds
Flags to build a local build using homebrew packages are not
default and require parameter -b to build. We also don't build
packages directly, which requires -p.
* Fix wxwidgets not linking in local x86 macOS development builds
* Clarify build location in the document
* Add basic strcture needed for EMV implementation
* Add demo EMV functionality with C code pasted in a very dirty and unsafe way. NOT FINAL
* Refactor IccExtractor Structure
* Fix Makefile
* fix include file
* move global variables from h to c
* revert to memcpy
* fix icc data recovery functions
* Add EMV functionalities on windows
* Make EMVToken structures like SecurityToken
* Define constants instead of hard coded values
* Token structures created with inheritance
* refactor TokenKeyfile to use inherit. + polymor.
* add Token.h + Token.cpp in modules in VS2010
* Add a comment at each use of SecurityToken class or objects
* SecurityTokenKeyfilesDialog preparation
* Implemennt GetAvailableTokens in Token class on windows
* merge
* up (patching for Windows)
* foreach Token.cpp corrected
* Display EMV keyfiles on first window in graphic interface
* Add token to Windows UI
* EMVToken selection on OKButton on Linux
* Keyfile.cpp optimization
* Move getKeyfileData in the token class
* EMV::Token GetAvailableKeyfiles() base
* Move getKeyfileData in the token class on unix
* Remove test comments
* Warnings resolved
* RemoveeSecurityTokenLibraryNotInitialized exception if at least one emv token is detected
* Adding new files
* Remove old files and add the new version to the windows project
* Change make_shared to shared_ptr constructor
* IccExtractor integration working on linux
* Throwing card not EMV execption
* catch error when not EMV type in EMVToken::GetAvailableKeyfiles
* Change types to compile on windows
* list all keyfiles, security keyfiles and emv keyfiles in command line
* Change type to be coherent and remove old todo comments
* Remove todo comments
* Change indentation and resolve a bug from previous commit
* Use polymorphism for GetKeyfileData and add export option for EMVTokens on Linux
* Linux : Allow to export EMV Tokens in command lines, Windows : Disable the delete button when EMV Keyfiles are selected
* Remove SlotId from TokenInfo as it is already in Token
* Correct errors on Linux
* Disable delete option if one EMV Token is selected on Linux
* Fix bug enabling delete button if nothing is selected
* emv data used as reference then burnt
* use of normal files in linux corrected
* help updated
* help updated for export functionnality
* option EMV added to graphic interface but not yet working
* Bug fix : Allow to use multiple EMV on windows
* EMV Option added to UserPreferences
* EMV Option working for Linux
* EMV option added to Windows (not working yet)
* [NOT TESTED] EMV option for Windows
* Working EMV option on Windows
* EMV Option for data extraction working for volume creation
* EMV Option for data extraction working for Mount
* EMV Option for data extraction working for mounting favorites volumes
* EMV Option for extraction working for Changing volume password, Set Derivation Key Algorithm and Add or remove keyfile from volume
* Windows : re-checking EMV Option when getting data
* Removing error catches in the IccDataExtractor classe (It only throws error now). Changing GetPan signature to resemble the other functions signatures more
* Changing EMV errors
- Only throwing ICCExtractionException from outside of the ICC module.
- Catching all TLVExceptions and PCSCExceptions to throw the right ICCExtractionException
- Deleting APDU exceptions.
* First version of the documentation
* Adding function pointers for winscard library (but it crashes VeraCrypt)
* Debugging function pointers
* The import of the library on windows work as expected now
* Reverting EMVToken.cpp changes used to test to library import
* Searching for the System32 path instead of hard codding it
* Fixing the bug were VeraCrypt crashes if there is no readers when "add Token files" is clicked
* Winscard library not initialized in object constructor anymore to delay it after EMVOption check
* Remove winscard lib from windows dependencies
* Properly displaying errors
* Adding a dot in Language.xml
* Catching TLVException
* Removing unused code
* Remove unusefull comments
* Trying to fix 0x1f error
* Update IccDataExtractor.cpp
* Delete History.xml
* Fix get data without get pan
* Cleanup code
* changes for linux compilation but linking not working
* error handling for linux
* erasing emv data
* Burn PAN
* Burn PAN from memory
* Uncomment selfcheck before merging master
* burn corrected
* EMV errors handling for Linux
* EMV working for Linux CLI
* Doc : Winscard Linux package and VeraCrypt versions
---------
Co-authored-by: doriandu45 <d45.poubelle@gmail.com>
Co-authored-by: red4game <redemgaiming@gmail.com>
Co-authored-by: Brice.Namy <brice.namy@insa-rennes.fr>
Co-authored-by: vocthor <pieceo108@gmail.com>
Co-authored-by: vocthor <67202139+vocthor@users.noreply.github.com>
Co-authored-by: Andrei COCAN <andrei.cocan@insa-rennes.fr>
Co-authored-by: AndreiCocan <95496161+AndreiCocan@users.noreply.github.com>
Co-authored-by: francoisLEROUX <francois3443@gmail.com>
Ville Takio
Mounir IDRASSI
uni-kod
Deniz Türkoglu
lealem47
Christopher Bergqvist
alt3r 3go