Bedienungsanleitung VeraCrypt 1.16 (Seite 141 von 162) (Englisch)

658731

141

Zoom out

Zoom in

Vorherige Seite

1/162

Nächste Seite

137

Encryption Scheme

When mounting a VeraCrypt volume (assume there are no cached passwords/keyfiles) or when

performing pre-boot authentication, the following steps are performed:

1. The first 512 bytes of the volume (i.e., the standard volume header) are read into RAM, out

of which the first 64 bytes are the salt (see VeraCrypt Volume Format Specification). For

system encryption (see the chapter System Encryption), the last 512 bytes of the first logical

drive track are read into RAM (the VeraCrypt Boot Loader is stored in the first track of the

system drive and/or on the VeraCrypt Rescue Disk).

2. Bytes 65536–66047 of the volume are read into RAM (see the section VeraCrypt Volume

Format Specification). For system encryption, bytes 65536–66047 of the first partition

located behind the active partition

are read (see the section Hidden Operating System). If

there is a hidden volume within this volume (or within the partition behind the boot

partition), we have read its header at this point; otherwise, we have just read random data

(whether or not there is a hidden volume within it has to be determined by attempting to

decrypt this data; for more information see the section Hidden Volume).

3. Now VeraCrypt attempts to decrypt the standard volume header read in (1). All data used

and generated in the course of the process of decryption are kept in RAM (VeraCrypt never

saves them to disk). The following parameters are unknown

†

and have to be determined

through the process of trial and error (i.e., by testing all possible combinations of the

following):

a. PRF used by the header key derivation function (as specified in PKCS #5 v2.0; see

the section Header Key Derivation, Salt, and Iteration Count), which can be one of

the following:

HMAC-SHA-512, HMAC-SHA-256, HMAC-RIPEMD-160, HMAC-Whirlpool. If a

PRF is explicitly specified by the user, it will be used directly without trying the other

possibilities.

A password entered by the user (to which one or more keyfiles may have been

applied – see the section Keyfiles), a PIM value (if specified) and the salt read in (1)

are passed to the header key derivation function, which produces a sequence of

values (see the section Header Key Derivation, Salt, and Iteration Count) from

which the header encryption key and secondary header key (XTS mode) are

formed. (These keys are used to decrypt the volume header.)

b. Encryption algorithm: AES-256, Serpent, Twofish, AES-Serpent, AES-Twofish-

Serpent, etc.

c. Mode of operation: only XTS is supported.

d. Key size(s)

If the size of the active partition is less than 256 MB, then the data is read from the second partition behind the active one

(Windows 7 and later, by default, do not boot from the partition on which they are installed).

†

These parameters are kept secret not in order to increase the complexity of an attack, but primarily to make VeraCrypt volumes

unidentifiable (indistinguishable from random data), which would be difficult to achieve if these parameters were stored unencrypted

within the volume header. Also note that if a non-cascaded encryption algorithm is used for system encryption, the algorithm is

known (it can be determined by analyzing the contents of the unencrypted VeraCrypt Boot Loader stored in the first logical drive

track or on the VeraCrypt Rescue Disk).

Missbrauch melden von Frage und/oder Antwort

Libble nimmt den Missbrauch seiner Dienste sehr ernst. Wir setzen uns dafür ein, derartige Missbrauchsfälle gemäß den Gesetzen Ihres Heimatlandes zu behandeln. Wenn Sie eine Meldung übermitteln, überprüfen wir Ihre Informationen und ergreifen entsprechende Maßnahmen. Wir melden uns nur dann wieder bei Ihnen, wenn wir weitere Einzelheiten wissen müssen oder weitere Informationen für Sie haben.

VeraCrypt 1.16 Seite 141

Brauchen Sie Hilfe? Stellen Sie Ihre Frage.

Missbrauch melden von Frage und/oder Antwort

Art des Missbrauchs:

Forenregeln

Neu registrieren

Das Handbuch wird per E-Mail gesendet. Überprüfen Sie ihre E-Mail.

Ihre Frage wurde zu diesem Forum hinzugefügt

Info