Biggest flaw in VeraCrypt(or other Encryption programs) is Hash Algorithm. VeraCrypt hashes (SHA,Whirlpool,Streebog) it is the only point where can break an encrypted disk. Because break algorithm (AES,Towish,Camellia,Serpent,Kuznyechik) it is practically impossible. VeraCrypt hashes can be broken by Police with the appropriate cash input. Hashcat can break VeraCrypt hashes.

How to protect against it? Will longer mouse movements help? And hashes are really so dangerous?

I invite to the discussion.

  • $\begingroup$ Is it broken because of weakness in hashes or bad choise of passwords? $\endgroup$ – hardyrama Aug 26 '18 at 16:26
  • 1
    $\begingroup$ A SHA2/3 hash with adequate length can be as hard (and harder) to break as AES&Co. Please tell us why you think that hashes are the biggest problem, because as you can see we don't automatically agee. $\endgroup$ – deviantfan Aug 26 '18 at 17:44
  • $\begingroup$ I'm voting to close this question as off-topic because this is not a forum for discussions (too broad). Instead, this is a Q&A site. $\endgroup$ – e-sushi Aug 29 '18 at 14:31
  • $\begingroup$ I thought of the hashes,, they are the weakest point, I was heard that the police try to break VeraCrypt based on breaking the hash. But I know that my fears were wrong. I'm closing discussions. $\endgroup$ – P3aC3 Aug 30 '18 at 18:42

VeraCrypt hashes can be broken by Police with the appropriate cash input. Hashcat can break VeraCrypt hashes.

Breaking a hash algorithm and brute-forcing a hash input are 2 completely different attacks. Veracrypt uses PBKDF2 with half a million iterations for volume containers, which is an appropriate amount. The weak point which allows recovery of a Veracrypt volume is the strength of the password

How to protect against it?

Use better passwords and keyfiles, and use a bigger iteration count (PIM)

Will longer mouse movements help?

No, that has little to do with the password hash strength

And hashes are really so dangerous?

No, poor choices of passwords and bad opsec are dangerous, it is easier to install hidden cameras and observe keyboard input, or to use torture


VeraCrypt uses:

  • RIPEMD-160: This is an old hash function that is still thought to be secure. It is the oldest hash function in there and the least likely to remain secure, if just for the limited state and output size.
  • SHA-256 and SHA-512: These are two SHA-2 hashes that are most commonly used and thought to be secure. Although their design has a lot in common with SHA-1, the internal calculations are much more complex. One of the finds of the SHA-3 hash competition was that SHA-2 hash functions are still considered secure.
  • Whirlpool: although there have been some changes to the earlier versions of Whirlpool, all versions are still thought to be secure. However, the second revision (or third version) of Whirlpool is used in VeraCrypt. This is the most secure version of the three.
  • Streebog: this is an update of the Russian GOST hash. Russia has it's own set of cryptographic algorithms, just like China has. Although the Russians prefer their own hashing standards, those standards have been build upon the modern crypto propagated by the Western countries, mainly the USA.

    With a complex round function and Merke Damgard construction, it is not likely to be broken anytime soon. It has been created by an open competition; the best attacks are on 5/6 rounds out of 12 with a completely unrealistic amount of CPU and/or memory requirements. It does have some less-explained constants.

Neither of these hash functions are considered broken. Besides that, VeraCrypt uses these hashes solely for the pool mixing function and the KDF. The pool mixing function and KDF have very low requirements on the one-way-function that is used. Actually, you could use the severely broken MD5 function and get away with it.

So basically, if anything breaks with regards to the hash function then it's the amount of entropy within the input. The entropy gathered within the entropy pool could be borked. But it is much more likely that the password used to encrypt a VeraCrypt volume is be badly chosen. It is very unlikely that the hash function is vulnerable itself, but that doesn't mean that the input of the Key Derivation Function cannot be guessed using a dictionary attack.

If you want to choose between the offered hashes I'd choose SHA-512. It's a modern, well studied function that has a large output size, high security and is rather fast on 64 bit architectures. Due to its table-less design it is unlikely to leak information through side channel analysis as well. However, any of the above hash functions will provide plenty of security.

  • $\begingroup$ Thank you, for your answer. I mostly use SHA-512 or Whirlpool. $\endgroup$ – P3aC3 Aug 27 '18 at 10:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.