Veracrypt question

[Bunger]

@cooldude

Hi, just to be sure when understanding PIM. So what you are saying is, if the value of PIM is below 485 you are actually decreasing the strength of the setup? This seems crazy to me. How is this not warned with big letters during creation of a volume?

Yes, if you set a value less than 485, you are decreasing the brute-force resistance than what the default provides. I presume it is not warned because people are encouraged to look up things they do not understand and read documentation.

@cooldude

I mean, what if you have no idea and just type 20 or something?

Then you are decreasing the brute-force resistance of your volume.

@cooldude

By what do they say here, I understand that if your pass is less than 20 characters, then it will always use 485 minimum (even if you enter a lower PIM, it will override it and use 485 for iterations is what they mean?)

I am unsure what you mean by this. The PIM is completely independent from the password. The PIM doesn’t change based on password length.

@cooldude

Well but what if your password is 20+ chars and you literally type 1 PIM? The way they phrase this here I understand that it actually weakens the encryption:

No, it doesn’t weaken the encryption itself. A PIM only impacts how difficult it is to derive a key from a password. I will show math below as an example. It is very technical and not super important to understand. Just know that a higher PIM = harder to brute-force password guesses.

Math

Iterations = 15,000 + (PIM×1,000)

So…

• PIM 20: 15,000 + 20,000 = 35,000 iterations

• PIM 100: 15,000 + 100,000 = 115,000 iterations

• PIM 1000: 15,000 + 1,000,000 = 1,015,000 iterations

• Memory cost (MiB):
  m_cost(pim) = min(64 MiB + (pim - 1) × 32 MiB, 1024 MiB) — i.e. memory grows by 32 MiB per PIM step until it caps at 1024 MiB. VeraCrypt

• Time cost (passes / iterations):

  • If PIM ≤ 31: time = 3 + floor((PIM − 1) / 3)

  • If PIM > 31: time = 13 + (PIM − 31)

PIM = 20

• Memory = 64 + (20−1)*32 = 64 + 608 = 672 MiB

• Time (passes) = 3 + floor((20−1)/3) = 3 + 6 = 9 passes.

• Work factor (rough proxy) ≈ 672 MiB × 9 ≈ 6,048 MiB·passes.

PIM = 100

• Memory = capped at 1024 MiB.

• Time = 13 + (100 − 31) = 13 + 69 = 82 passes.

• Work factor ≈ 1024 × 82 = 83,968 MiB·passes.

PIM = 1000

• Memory = capped at 1024 MiB.

• Time = 13 + (1000 − 31) = 13 + 969 = 982 passes.

• Work factor ≈ 1024 × 982 = 1,006,208 MiB·passes.

PIM 20: 6,048 MiB·passes

PIM 100: 83,968 MiB·passes (~13.9× harder than PIM20)

PIM 1000: 1,006,208 MiB·passes (~167× harder than PIM20).

Using a baseline of 1,000 guesses/second:

Guesses/sec at PIM20 = 1,000 g/s (baseline)
Guesses/sec at PIM100 ≈ 1,000 / 13.9 ≈ 72 g/s
Guesses/sec at PIM1000 ≈ 1,000 / 167 ≈ 6 g/s

@cooldude

So the first point is obvious.. okay 3 more numbers for an attacker to guess. Is this relevant for someone with firepower to bruteforce? I guess it helps.

Yes, maybe only a little but still helps.

@cooldude

The second point, I understand you increase protection against bruteforce, as long as it’s longer than 98 or 485 for sha256/sha512.

Yes, if your PIM is higher than 485 it will increase the cost to brute-force your password.

@cooldude

The third point is what seems shocking. It basically means, use a lower value to decrypt faster (because your encryption protection is weaker).

Yes, using a lower PIM is only really advised if mounting to older devices that are slower.

@cooldude

And they should remind that this applies only to passwords shorter than 20 characters if I understood this correctly above

No, PIM applies to any password length. If I were to guess where you are messing up is if you have a very long and complex password, it doesn’t matter if your PIM is 1, it will be too difficult to brute-force anyway.

@cooldude

If you go in there on the VeraCrypt volume creation wizard, you are not told that if you enter a value lower than 98 or 485 for sha256 and sha512 respectively, you are actually decreasing the strength of the encryption… wtf. I mean what if you enter a really low value and you have no idea about this? This is pretty lame tbh.

Correct. Like I said, I think the dev expects people to research things they don’t understand. VeraCrypt isn’t meant to be used by grandma. It’s meant for power users who want more control. I never inputted random numbers for anything when I was first learning VC. This is not to diss or anything, I would just research what everything does before touching it.

@cooldude

Well at least you can tweak the PIM value it seems without having to redo the entire thing (or maybe you do because on the screenshot it looks like it wipes the contents)

Yes you can change it and no you do not need to wipe the contents. The PIM information is stored in the header of the container.

@cooldude

This also adds an interesting/odd dynamic here… like, how many people may just put 999 in there because it’s the max security. So what if someone guesses the 999 number right? Isn’t this less safe than a lower less obvious value?

No. PIM is not a true secret and shouldn’t be used as one. The main purpose of using a PIM is to maintain a higher cost of brute-forcing your password for the container. It is not meant to be used as a “you’ll never guess this.” because as stated earlier, if your adversary can brute-force at high numbers like a government agency, testing 1,000 PIMS on top of the brute-force isn’t very difficult.

@cooldude

For an attacker it also potentially shortens the number of values from 485 and below because most people may not want to decrease but increase the effectiveness of the encryption (so an attacker has less numbers to guess is what I mean).

Yes, but it doesn’t matter much. See the last response. The PIM isn’t meant to be a “secret” as much as a technical feature, that’s just it’s secondary “side” feature you could say. Hypothetically speaking, If you had a 128-character password and told the NSA your PIM was 485 OR EVEN 20, they wouldn’t really be able to do much. Brute forcing a 128-character truly random password with a PIM of 1 would exceed the lifetime of the universe by magnitudes of hundreds. It is, practically speaking, impossible.

@cooldude

Just considering all possible angles of this, hope it makes sense?

I get it. It’s very easy to get wrapped up in the technicals of things. Just make sure your password is secure. If you are using a truly random 128-character password, the first weakness I think of is storage. Most people cannot reasonably remember that long of a password, they have to store it somewhere. If I were an adversary, my attack vector would be gaining access to that password.

Piece of paper in a safe? How can I break into that safe without damaging the paper.

Online password manager? How can I get into your password vault exploiting the online nature of it?

Offline password manager? How can I infect your PC with malware to gain access to RAM contents to then exfiltrate your database and access it on my own hardware.

Most people are a lot weaker than their encryption. If your adversary knows they can’t crack the encryption, they will try and crack YOU. Remember this. You are only as strong as your weakest link, and that is usually yourself.