ea = TWOFISH;

else if (_stricmp (request.BootEncryptionAlgorithmName, "Camellia") == 0)

ea = CAMELLIA;

if (_stricmp(request.BootPrfAlgorithmName, "SHA-256") == 0)

pkcs5_prf = SHA256;

else if (_stricmp(request.BootPrfAlgorithmName, "SHA-512") == 0)

pkcs5_prf = SHA512;

else if (_stricmp(request.BootPrfAlgorithmName, "Whirlpool") == 0)

else if (_stricmp(request.BootPrfAlgorithmName, "Streebog") == 0)

pkcs5_prf = STREEBOG;

else if (strlen(request.BootPrfAlgorithmName) == 0) // case of version < 1.0f

}

catch (...)

{

pkcs5_prf = SelectedPrfAlgorithmId;

}

throw ParameterIncorrect (SRC_POS);

int bootSectorId = 0;

EfiBootConf::EfiBootConf() : passwordType (0),

passwordMsg ("Password: "),

passwordPicture ("login.bmp"),

hashAlgo (0),

requestHash (0),

pimMsg ("PIM (Leave empty for default): "),

passwordType = ReadConfigInteger (configContent, "PasswordType", 0);

passwordMsg = ReadConfigString (configContent, "PasswordMsg", "Password: ", buffer, sizeof (buffer));

passwordPicture = ReadConfigString (configContent, "PasswordPicture", "\\EFI\\VeraCrypt\\login.bmp", buffer, sizeof (buffer));

hashAlgo = ReadConfigInteger (configContent, "Hash", 0);

requestHash = ReadConfigInteger (configContent, "HashRqt", 1);

pimMsg = ReadConfigString (configContent, "PimMsg", "PIM: ", buffer, sizeof (buffer));

{ SERPENT, L"Serpent", 16, 32, 140*4 },

{ TWOFISH, L"Twofish", 16, 32, TWOFISH_KS },

{ CAMELLIA, L"Camellia", 16, 32, CAMELLIA_KS },

{ KUZNYECHIK, L"Kuznyechik",16, 32, KUZNYECHIK_KS },

#endif

{ 0, 0, 0, 0, 0 }

{ { SERPENT, 0 }, { XTS, 0 }, 1, 1 },

{ { TWOFISH, 0 }, { XTS, 0 }, 1, 1 },

{ { CAMELLIA, 0 }, { XTS, 0 }, 1, 1 },

{ { KUZNYECHIK, 0 }, { XTS, 0 }, 0, 1 },

{ { TWOFISH, AES, 0 }, { XTS, 0 }, 1, 1 },

{ { SERPENT, TWOFISH, AES, 0 }, { XTS, 0 }, 1, 1 },

{ // ID Name Deprecated System Encryption

{ SHA512, L"SHA-512", FALSE, FALSE },

{ WHIRLPOOL, L"Whirlpool", FALSE, FALSE },

{ SHA256, L"SHA-256", FALSE, TRUE },

{ STREEBOG, L"Streebog", FALSE, FALSE },

{ 0, 0, 0 }

};

#endif

#if !defined(TC_WINDOWS_BOOT)

case KUZNYECHIK:

kuznyechik_set_key(key, (kuznyechik_kds*)ks);

break;

case CAMELLIA: camellia_encrypt (data, data, ks); break;

#endif

#if !defined(TC_WINDOWS_BOOT)

case KUZNYECHIK: kuznyechik_encrypt_block(data, data, ks); break;

#endif // !defined(TC_WINDOWS_BOOT)

default: TC_THROW_FATAL_EXCEPTION; // Unknown/wrong ID

#endif

}

#endif

else

{

size_t blockSize = CipherGetBlockSize (cipher);

case CAMELLIA: camellia_decrypt (data, data, ks); break;

#endif

#if !defined(TC_WINDOWS_BOOT)

case KUZNYECHIK: kuznyechik_decrypt_block(data, data, ks); break;

#endif // !defined(TC_WINDOWS_BOOT)

#endif

}

#endif

else

{

size_t blockSize = CipherGetBlockSize (cipher);

BOOL CipherSupportsIntraDataUnitParallelization (int cipher)

{

return (cipher == AES && IsAesHwCpuSupported())

#if CRYPTOPP_BOOL_SSE2_INTRINSICS_AVAILABLE && !defined (_UEFI)

|| (cipher == SERPENT && HasSSE2())

|| (cipher == KUZNYECHIK && HasSSE2())

SHA512 = FIRST_PRF_ID,

WHIRLPOOL,

SHA256,

STREEBOG,

HASH_ENUM_END_ID

};

// The last PRF to try when mounting and also the number of implemented PRFs

#define LAST_PRF_ID (HASH_ENUM_END_ID - 1)

#define SHA256_BLOCKSIZE 64

#define SHA256_DIGESTSIZE 32

SERPENT,

TWOFISH,

CAMELLIA,

KUZNYECHIK

};

#ifdef TC_WINDOWS_BOOT

#define MAX_EXPANDED_KEY VC_MAX((AES_KS + SERPENT_KS + TWOFISH_KS), CAMELLIA_KS)

#else

#endif

#endif

#endif

#include "Twofish.h"

#ifndef TC_WINDOWS_BOOT

# include "Sha2.h"

# include "Whirlpool.h"

# include "Streebog.h"

# include "kuznyechik.h"

# include "Camellia.h"

#if !defined (_UEFI)

uint16 HeaderVersion;

#ifdef TC_WINDOWS_DRIVER

#else

CRYPTOPP_ALIGN_DATA(16) unsigned __int8 master_keydata[MASTER_KEYDATA_SIZE]; /* This holds the volume header area containing concatenated master key(s) and secondary key(s) (XTS mode). For LRW (deprecated/legacy), it contains the tweak key before the master key(s). For CBC (deprecated/legacy), it contains the IV seed before the master key(s). */

CRYPTOPP_ALIGN_DATA(16) unsigned __int8 k2[MASTER_KEYDATA_SIZE]; /* For XTS, this contains the secondary key (if cascade, multiple concatenated). For LRW (deprecated/legacy), it contains the tweak key. For CBC (deprecated/legacy), it contains the IV seed. */

{

BYTE digest [MAX_DIGESTSIZE];

WHIRLPOOL_CTX wctx;

sha512_ctx s2ctx;

sha256_ctx s256ctx;

STREEBOG_CTX stctx;

sha256_end ((unsigned char *) digest, &s256ctx);

break;

break;

case WHIRLPOOL:

derive_key_sha256 ("passphrase-1234567890", 21, tmp_salt, 64, get_pkcs5_iteration_count(thid, benchmarkPim, FALSE, benchmarkPreBoot), dk, MASTER_KEYDATA_SIZE);

break;

break;

case WHIRLPOOL:

SetWindowText(GetDlgItem(hwndDlg, IDC_CIPHERTEXT), L"0000000000000000");

if (idTestCipher == AES || idTestCipher == SERPENT || idTestCipher == TWOFISH || idTestCipher == CAMELLIA

|| idTestCipher == KUZNYECHIK

)

{

case DeriveKeyWork:

switch (workItem->KeyDerivation.Pkcs5Prf)

{

workItem->KeyDerivation.IterationCount, workItem->KeyDerivation.DerivedKey, GetMaxPkcs5OutSize());

break;

#include <memory.h>

#include <stdlib.h>

#endif

#ifndef TC_WINDOWS_BOOT

#include "Sha2.h"

#include "Whirlpool.h"

#endif // TC_WINDOWS_BOOT

{

{

/**** Restore Precomputed Inner Digest Context ****/

/**** Restore Precomputed Outer Digest Context ****/

}

#ifndef TC_WINDOWS_BOOT

{

{

ctx = &(hmac.inner_digest_ctx);

ctx = &(hmac.outer_digest_ctx);

#endif

{

char* k = hmac->k;

char* u = hmac->u;

uint32 c;

#ifdef TC_WINDOWS_BOOT

/* In bootloader mode, least significant bit of iterations is a boolean (TRUE for boot derivation mode, FALSE otherwise)

c = iterations >> 16;

i = ((int) iterations) & 0x01;

if (i)

else

#else

#endif

/* iteration 1 */

/* big-endian block number */

#ifdef TC_WINDOWS_BOOT

memset (&k[salt_len], 0, 3);

k[salt_len + 3] = (char) b;

#else

memcpy (&k[salt_len], &b, 4);

#endif

/* remaining iterations */

{

{

u[i] ^= k[i];

}

}

}

{

int b, l, r;

#ifndef TC_WINDOWS_BOOT

/* If the password is longer than the hash algorithm block size,

{

#endif

{

}

else

{

}

ctx = &(hmac.inner_digest_ctx);

ctx = &(hmac.outer_digest_ctx);

/* first l - 1 blocks */

for (b = 1; b < l; b++)

{

}

/* last block */

memcpy (dk, hmac.u, r);

/* Prevent possible leaks. */

burn (&hmac, sizeof(hmac));

#ifndef TC_WINDOWS_BOOT

#endif

}

#ifndef TC_WINDOWS_BOOT

case SHA256:

return L"HMAC-SHA-256";

case WHIRLPOOL:

return L"HMAC-Whirlpool";

switch (pkcs5_prf_id)

{

if (truecryptMode)

else if (pim == 0)

else

{

return bBoot? pim * 2048 : 15000 + pim * 1000;

if (truecryptMode)

{

if ( (bootType == PRF_BOOT_GPT)

)

return 0;

}

else

{

|| (bootType != PRF_BOOT_MBR && (pkcs5_prf_id < FIRST_PRF_ID || pkcs5_prf_id > LAST_PRF_ID))

)

return 0;

extern "C"

{

#endif

/* output written to d which must be at lease 32 bytes long */

void hmac_sha256 (char *k, int lk, char *d, int ld);

{

unsigned char hashOutputBuffer [MAX_DIGESTSIZE];

WHIRLPOOL_CTX wctx;

sha512_ctx sctx;

sha256_ctx s256ctx;

STREEBOG_CTX stctx;

switch (HashFunction)

{

break;

case SHA512:

/* Compute the message digest of the entire pool using the selected hash function. */

switch (HashFunction)

{

break;

case SHA512:

burn (hashOutputBuffer, MAX_DIGESTSIZE);

switch (HashFunction)

{

break;

case SHA512:

/* RNG defines & pool pointers */

#define RNG_POOL_SIZE 320 // Must be divisible by the size of the output of each of the implemented hash functions. (in bytes)

#error RNG_POOL_SIZE must be divisible by the size of the output of each of the implemented hash functions.

#endif

#endif // defined(_UEFI)

#define TC_APP_NAME "VeraCrypt"

// Version displayed to user

typedef __int16 int16;

typedef __int32 int32;

typedef unsigned __int8 byte;

typedef unsigned __int16 uint16;

typedef unsigned __int32 uint32;

typedef int32_t int32;

typedef int64_t int64;

typedef uint8_t byte;

typedef uint16_t uint16;

typedef uint32_t uint32;

typedef uint64_t uint64;

0xAD, 0x5C, 0x4D, 0x84

}

};

// Kuznyechik ECB test vectors

#define KUZNYECHIK_TEST_COUNT 4

"\xe3\x7b\x6a\x77\x5d\xc8\x7d\xba\xa4\xdf\xa9\xf9\x6e\x5e\x3f\xfd\xde\xbd\x71\xf8\x86\x72\x89\x86\x5d\xf5\xa3\x2d\x20\xcd\xc9\x44\xb6\x02\x2c\xac\x3c\x49\x82\xb1\x0d\x5e\xeb\x55\xc3\xe4\xde\x15\x13\x46\x76\xfb\x6d\xe0\x44\x60\x65\xc9\x74\x40\xfa\x8c\x6a\x58",

};

{

};

{

};

{

};

char *hmac_whirlpool_test_key =

{NULL, NULL}

};

unsigned char ks_tmp[MAX_EXPANDED_KEY];

void CipherInit2(int cipher, void* key, void* ks, int key_len)

case CAMELLIA:

CipherInit(cipher,key,ks);

break;

case KUZNYECHIK:

CipherInit(cipher, key, ks);

break;

break;

}

}

else if (wcscmp (name, L"Kuznyechik") == 0)

{

switch (testCase)

return FALSE;

nTestsPerformed++;

}

else if (wcscmp (name, L"Kuznyechik") == 0)

{

if (crc != 0xd6d39cdb)

nTestsPerformed++;

}

}

static BOOL DoAutoTestAlgorithms (void)

if (i != KUZNYECHIK_TEST_COUNT)

bFailed = TRUE;

/* PKCS #5 and HMACs */

if (!test_pkcs5 ())

bFailed = TRUE;

return (nTestsPerformed == 6);

}

{

unsigned int i;

{

char digest[1024]; /* large enough to hold digets and test vector inputs */

return FALSE;

else

nTestsPerformed++;

}

}

BOOL test_hmac_whirlpool ()

if (!test_hmac_sha512())

return FALSE;

return FALSE;

/* HMAC-Whirlpool tests */

if (memcmp (dk, "\x13\x64\xae\xf8\x0d\xf5\x57\x6c\x30\xd5\x71\x4c\xa7\x75\x3f\xfd\x00\xe5\x25\x8b\x39\xc7\x44\x7f\xce\x23\x3d\x08\x75\xe0\x2f\x48\xd6\x30\xd7\x00\xb6\x24\xdb\xe0\x5a\xd7\x47\xef\x52\xca\xa6\x34\x83\x47\xe5\xcb\xe9\x87\xf1\x20\x59\x6a\xe6\xa9\xcf\x51\x78\xc6\xb6\x23\xa6\x74\x0d\xe8\x91\xbe\x1a\xd0\x28\xcc\xce\x16\x98\x9a\xbe\xfb\xdc\x78\xc9\xe1\x7d\x72\x67\xce\xe1\x61\x56\x5f\x96\x68\xe6\xe1\xdd\xf4\xbf\x1b\x80\xe0\x19\x1c\xf4\xc4\xd3\xdd\xd5\xd5\x57\x2d\x83\xc7\xa3\x37\x87\xf4\x4e\xe0\xf6\xd8\x6d\x65\xdc\xa0\x52\xa3\x13\xbe\x81\xfc\x30\xbe\x7d\x69\x58\x34\xb6\xdd\x41\xc6", 144) != 0)

return FALSE;

return FALSE;

return FALSE;

/* PKCS-5 test 1 with HMAC-Whirlpool used as the PRF */

void CipherInit2(int cipher, void* key, void* ks, int key_len);

BOOL test_hmac_sha512 (void);

BOOL test_hmac_whirlpool (void);

BOOL test_pkcs5 (void);

BOOL TestSectorBufEncryption ();

#ifndef DEVICE_DRIVER

#include "Random.h"

#endif

#endif // !defined(_UEFI)

switch (pkcs5_prf)

{

PKCS5_SALT_SIZE, keyInfo->noIterations, dk, GetMaxPkcs5OutSize());

break;

memcpy (keyInfo->master_keydata, header + HEADER_MASTER_KEYDATA_OFFSET, MASTER_KEYDATA_SIZE);

#ifdef TC_WINDOWS_DRIVER

{

burn(&ctx, sizeof (ctx));

}

#else

memcpy (cryptoInfo->master_keydata, keyInfo->master_keydata, MASTER_KEYDATA_SIZE);

derive_key_sha256 (password->Text, (int) password->Length, header + HEADER_SALT_OFFSET,

PKCS5_SALT_SIZE, iterations, dk, sizeof (dk));

#else

PKCS5_SALT_SIZE, iterations, dk, sizeof (dk));

#endif

#ifdef TC_WINDOWS_BOOT_SHA2

cryptoInfo->pkcs5 = SHA256;

#else

#endif

memcpy (dk, header + HEADER_MASTER_KEYDATA_OFFSET, sizeof (dk));

PKCS5_SALT_SIZE, keyInfo.noIterations, dk, GetMaxPkcs5OutSize());

break;

PKCS5_SALT_SIZE, keyInfo.noIterations, dk, GetMaxPkcs5OutSize());

break;