Some Questions about the Veracrypt hash functions

Question

Veracrypt has always been my favourite encryption tool since it came out . But still there are some things about the tool I don't understand .

1. Why is there the possibility to use sha256 or sha512 . This one does not make sense to me at all . As far as I know the output size of the Veracrypt KDF will always have the same length .... so why give the possibility to use a shorter or longer hash ? does it have any advantages ?
2. Why does Veracrypt use such strange hashes ? sha512 , Whirlpool , Streebog , etc ... Whirlpool is ( as far as I know ) not even officially a KDF . All thes hashes are rather collison resistant , but not one of them is suited as cryptographic strong hash function . Why not Argon2 , scrypt , bcrypt , ..?
3. Why is Veracrypt GPU resistant ? Attacking a VC hash with a GPU is slow . Why ? I don't see any GPU attack countermesures . All the hashes are well implemented in GPU . they pass through PIM which ( I think ) rehashes the output of the last hash with the same algo . And then they pass through PBKDF2 at some point . But even PBKDF2 is rather GPU friendly .

Answer 1

1. These hash functions are also used for the key derivation function. Both are roughly equally secure for a KDF in the sense of collision resistance etc., but SHA512 offers a bit more security as countermeasure for custom hardware attacks, since the memory requirements are a higher than for SHA256 and custom hardware to crack the passwords like FPGAs is more expensive. So there is a small advantage using SHA512, even if the output is truncated at the end.

2. Although I can’t explain VeraCrypt’s selection of hash algorithms, it is not a bad idea to offer a variety of functions as a countermeasure to custom hardware attacks with ASICs, as these chips must be produced for each algorithm. This could also be a reason for using different SHA variants. I agree with you, that Argon2, scrypt, bcrypt would be better than PBKDF2, which remains vulnerable to custom hardware attacks even at high iterations. But VeraCrypt took the poor design of TrueCrypt, where all possible combinations of key derivation are tested in a trial and error process (see chapter 3 of VeraCrypt encryption scheme). This limits the amount of time for all key derivation functions (see Bill Cox's Responses). So if it would test PBKDF2, Argon2 and scrypt in sequence, the latency would increase drastically.

3. I don’t know if or why VeraCrypt is GPU resistant. hashcat supports GPUs to crack VeraCrypt volumes, but I don’t know anything about the performance.