Penetration Test Report (QuarksLab): VeraCrypt Audit Final for Public Release

VeraCrypt 1.18 Security Assessment
Technical Report
Ref. 16-08-215-REP
Version 1.0
Date 17 October, 2016
Prepared for OSTIF
Performed by Quarkslab
Contents
1 Project information 3
2 Executive Summary 4
2.1 Fixes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
2.2 New Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
3 Context and Scope 6
4 Known Vulnerabilities in TrueCrypt 7.1a 7
4.1 Vulnerabilities Detailed in OCAP Phase 1. . . . . . . . . . . . . . . . . . . . . . 7
4.2 Vulnerabilities Detailed in OCAP Phase 2. . . . . . . . . . . . . . . . . . . . . . 14
4.3 Vulnerabilities Reported by James Forshaw . . . . . . . . . . . . . . . . . . . . . 17
5 VeraCrypt’s Modifications Assessment 19
5.1 The Length of the Password Can Be Computed When Encryption Is Activated . 19
5.2 Data Compression: Too Many Different Critical Issues. . . . . . . . . . . . . . . 20
5.3 IntegerOverflowWhenComputingtheNumberofIterationsforPBKDF2When
PIM Is Used . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
5.4 PIN Code on Command Line . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
6 New Cryptographic Mechanisms Assessment 24
6.1 GOST 28147-89 Must Be Removed from VeraCrypt . . . . . . . . . . . . . . . . 24
6.2 Lack of Test Vectors for Newly Added Algorithms . . . . . . . . . . . . . . . . . 26
6.3 Input and Output Parameters Are Swapped in GOST Magma . . . . . . . . . . 27
6.4 Notes on the PBKDF2 Implementation . . . . . . . . . . . . . . . . . . . . . . . 28
6.5 Random Byte Generators in DCS Should Be Improved . . . . . . . . . . . . . . 30
7 UEFI Support Assessment 32
7.1 Keystrokes Are Not Erased After Authentication . . . . . . . . . . . . . . . . . . 32
7.2 Sensitive Data Is Not Correctly Erased . . . . . . . . . . . . . . . . . . . . . . . 33
7.3 Memory Corruption Can Occur When the Recovery Disk Is Read . . . . . . . . 33
7.4 Mistakes in the DCS Code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
8 Recommendations 38
8.1 Unfixed or Partially Fixed Vulnerabilities from Former Audits . . . . . . . . . . 38
8.2 VeraCrypt’s Modifications Assessment . . . . . . . . . . . . . . . . . . . . . . . . 39
8.3 New Cryptographic Mechanisms Assessment . . . . . . . . . . . . . . . . . . . . 39
8.4 UEFI Support Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
9 Conclusion 42
Bibliography 43
1. Project information
Document Change Log
Version Date Change Authors
0.1 18/08/2016 Creation Marion Videau
0.2 09/09/2016 First draft Jean-Baptiste Bédrune
sent to VeraCrypt Marion Videau
0.3 14/09/2016 Second draft Jean-Baptiste Bédrune
sent to VeraCrypt Marion Videau
0.8 16/09/2016 Draft internally reviewed Jean-Baptiste Bédrune
Marion Videau
0.9 20/09/2016 Reviewed Fred Raynal
0.9 30/09/2016 Reviewed Mounir Idrassi
1.0 05/10/2016 Delivered to OSTIF Jean-Baptiste Bédrune
Marion Videau
1.0 13/10/2016 Reviewed Derek Zimmer
1.0 17/10/2016 Published
Quarkslab
Quarkslab SAS, 13 rue Saint Ambroise, 75011 Paris, France
Contact Role Contact information
Frédéric Raynal CEO and Founder fraynal@quarkslab.com
Jean-Baptiste Bédrune R&D Engineer jbbedrune@quarkslab.com
Marion Videau R&D Engineer mvideau@quarkslab.com
Open Source Technology Improvement Fund
Contact Role Contact information
Derek Zimmer President and Founder derek@ostif.org
VeraCrypt Project
Contact Role Contact information
Mounir Idrassi Main Developer mounir.idrassi@idrix.fr
Ref.: 16-08-215-REP Quarkslab SAS 3
2. Executive Summary
ThisreportdescribestheresultsofthesecurityassessmentofVeraCrypt1.18madebyQuarkslab
between Aug. 16 and Sep. 14, 2016 and funded by OSTIF. Two Quarkslab engineers worked
on this audit, for a total of 32 man-days of study.
The audit followed two lines of work:
• The analysis of the fixes introduced in VeraCrypt after the results of the Open Crypto
Audit Project’s audit of TrueCrypt 7.1a have been published.
• The assessment of VeraCrypt’s features that were not present in TrueCrypt.
The new features of VeraCrypt include:
• Support for non western cryptographic algorithms,
• Compatibility with UEFI for system encryption,
• A better protection of the volume header keys.
VeraCrypt is a hard to maintain project. Deep knowledge of several operating systems, of the
Windowskernel, ofthesystembootchainandgoodconceptsincryptographyarerequired. The
improvements made by IDRIX demonstrate the possession of these skills.
2.1 Fixes
• All the vulnerabilities that have been taken into account have been correctly fixed (except
a minor missing fix for one of them). In particular, the problem leading to a privilege
escalation discovered by James Forshaw in the TrueCrypt driver just after the OCAP
audit has been solved.
• Vulnerabilities which require substantial modifications of the code or the architecture of
the project have not been fixed. These include:
– TC_IOCTL_OPEN_TEST multiple issues (need to change the application behavior),
– EncryptDataUnits() lacks error handling (need to design a new logic to retrieve
errors),
– AES implementation susceptible to cache-timing attacks (need to fully rewrite the
AES implementations).
• Vulnerabilities leading to incompatibilities with TrueCrypt, as the ones related to cryp-
tographic mechanisms, have not been fixed. Most notable are:
– Keyfile mixing is not cryptographically sound,
– Unauthenticated ciphertext in volume headers.
Ref.: 16-08-215-REP Quarkslab SAS 4
2.2 New Problems
Among the problems found during the audit, some must be corrected quickly:
• The availability of GOST 28147-89, a symmetric block cipher with a 64-bit block size, is
an issue. This algorithm must not be used in this context.
• Compression libraries are outdated or poorly written. They must be updated or replaced.
• If the system is encrypted, the boot password (in UEFI mode) or its length (in legacy
mode) could be retrieved by an attacker.
Finally, the UEFI loader is not mature yet. However, its use has not been found to cause
security problems from a cryptographic point of view.
Ref.: 16-08-215-REP Quarkslab SAS 5
3. Context and Scope
This report describes the security assessment made by Quarkslab on VeraCrypt. VeraCrypt is
a disk encryption software developed by IDRIX. It is derived from the now defunct TrueCrypt
project. ThisaudithasbeencarriedoutattherequestoftheOpenSourceTechnologyImprove-
ment Fund. Its goal was to evaluate the security of the features brought by VeraCrypt since
the publication of the audits on TrueCrypt 7.1a conducted by the Open Crypto Audit Project.
Two people from Quarkslab worked on this audit, for a total of 32 man-days of study:
• Jean-Baptiste Bédrune, Senior Security Researcher,
• Marion Videau, Senior Cryptographer and Chief Scientific Officer.
A first step consisted in verifying that the problems and vulnerabilities identified by [OCAP1]
and [OCAP2] in TrueCrypt 7.1a had been taken into account and fixed.
Then, the remaining study was to identify potential security problems in the code specific
to VeraCrypt. Contrary to other TrueCrypt forks, the goal of VeraCrypt is not only to fix
the public vulnerabilities of TrueCrypt, but also to bring new features to the software. The
innovations introduced by VeraCrypt include:
• The support of UEFI,
• The addition of non-occidental cryptographic algorithms (Camellia, Kuznyechik, GOST
28147-89, Streebog),
• A volume expander,
• A “Personal Iterations Multiplier” impacting the security of the derivation of the volume
header encryption keys,
• The support of UNICODE on Windows, and the use of StrSafe functions instead of
string.h,
• The gathering of entropy on mouse movements at each random number generation to
improve randomness and a better estimate of the randomness.
Some components of VeraCrypt have not been investigated, as they were already out of the
scope of the Open Crypto Audit Project. That includes the OS X and Linux versions of
VeraCrypt. Finally, it has been decided con