Release Notes

Note to users who created volumes with 1.17 version of VeraCrypt or earlier:
To avoid hinting whether your volumes contain a hidden volume or not, or if you depend on plausible deniability when using hidden volumes/OS, then you must recreate both the outer and hidden volumes including system encryption and hidden OS, discarding existing volumes created prior to 1.18a version of VeraCrypt.

1.24-Beta1 (January 12^th, 2019):

• Windows:
  • MBR Bootloader: dynamically determine boot loader memory segment instead of hardcoded values (proposed by neos6464)
  • MBR Bootloader: workaround for issue affecting creation of hidden OS on some SSD drives.
  • Fix issue related to Windows Update breaking VeraCrypt UEFI bootloader.
  • Support Multi-boot for EFI system encryption.
  • New security features:
  • Erase system encryption keys from memory during shutdown/reboot to help mitigate some cold boot attacks
  • Add option when system encryption is used to erase all encryption keys from memory when a new device is connected to the system.
  • Add new driver entry point that can be called by applications to erase encryption keys from memory in case of emergency.
  • Add mount option that allows mounting a volume without attaching it to the specified drive letter.
  • Update libzip to version 1.5.1
  • Do not create uninstall shortcut in startmenu when installing VeraCrypt. (by Sven Strickroth)
  • Enable selection of Quick Format for file containers creation. Separate Quick Format and Dynamic Volume options in the wizard UI.
  • Updates and corrections to translations and documentation.

1.23-Hotfix-2 (October 8^th, 2018):

• Windows:
  • Fix low severity vulnerability inherited from TrueCrypt that allowed reading 3 bytes of kernel stack memory (with a rare possibility of 25 additional bytes).
    • Reported by Tim Harrison.
  • Disable quick format when creating file containers from command line. Add /quick switch to enable it in this case if needed.
  • Add /nosizecheck switch to disable checking container size against available free space during its creation.
    • This enables to workaround a bug in Microsoft Distributed File System (DFS).

1.23 (September 12^th, 2018):

• Windows:
  • VeraCrypt is now compatible with default EFI SecureBoot configuration for system encryption.
  • Fix EFI system encryption issues on some machines (e.g. HP, Acer).
  • Support EFI system encryption on Windows LTSB.
  • Add compatibility of system encryption with Windows 10 upgrade using ReflectDrivers mechanism
  • Make EFI Rescue Disk decrypt partition correctly when Windows Repair overwrites first partition sector.
  • Add Driver option in the UI to explicitly allow Windows 8.1 and Windows 10 defragmenter to see VeraCrypt encrypted disks.
  • Add internal verification of binaries embedded signature to protect against some types to tampering attacks.
  • Fix Secure Desktop not working for favorites set to mount at logon on Windows 10 under some circumstances.
  • when Secure Desktop is enabled, use it for Mount Options dialog if it is displayed before password dialog.
  • when extracting files in Setup or Portable mode, decompress zip files docs.zip and Languages.zip in order to have ready to use configuration.
  • Display a balloon tip warning message when text pasted to password field is longer than maximum length and so it will be truncated.
  • Implement language selection mechanism at the start of the installer to make easier for international users.
  • Add check on size of file container during creation to ensure it's smaller than available free disk space.
  • Fix buttons at the bottom not shown when user sets a large system font under Window 7.
  • Fix compatibility issues with some disk drivers that don't support IOCTL_DISK_GET_DRIVE_GEOMETRY_EX ioctl.
• MacOSX:
  • Support pasting values to password fields using keyboard (CMD+V and CMD+A now working properly).
  • Add CheckBox in mount option dialog to force the use of embedded backup header during mount.
  • When performing backup of volume header, automatically try to use embedded backup header if using the main header fails.
  • Implement benchmarking UI for Hash and PKCS-5 PRF algorithms.
• Linux:
  • Don't allow waiting dialog to be closed before the associated operation is finished. This fix a crash under Lubuntu 16.04.
  • Add CheckBox in mount option dialog to force the use of embedded backup header during mount.
  • When performing backup of volume header, automatically try to use embedded backup header if using the main header fails.
  • Implement benchmarking UI for Hash and PKCS-5 PRF algorithms.
  • Remove limitation of hidden volume protection on disk with sector size larger than 512 bytes.

1.22 (March 30^th, 2018):

• All OSs:
  • SIMD speed optimization for Kuznyechik cipher implementation (up to 2x speedup).
  • Add 5 new cascades of cipher algorithms: Camellia-Kuznyechik, Camellia-Serpent, Kuznyechik-AES, Kuznyechik-Serpent-Camellia and Kuznyechik-Twofish.
• Windows:
  • MBR Bootloader: Fix failure to boot hidden OS on some machines.
  • MBR Bootloader: Reduce CPU usage during password prompt.
  • Security enhancement: Add option to block TRIM command for system encryption on SSD drives.
  • Implement TRIM support for non-system SSD drives and add option to enable it (TRIM is disabled by default for non-system volumes).
  • Better fix for "Parameter Incorrect" issues during EFI system encryption in some machines.
  • Driver: remove unnecessary dependency to wcsstr which can cause issues on some machines.
  • Driver: Fix "Incorrect Parameter" error when mounting volumes on some machines.
  • Fix failure to mount system favorites during boot on some machines.
  • Fix current application losing focus when VeraCrypt is run in command line with /quit /silent switches.
  • Fix some cases of external applications freezing during mount/dismount.
  • Fix rare cases of secure desktop for password dialog not visible which caused UI to block.
  • Update libzip to version 1.5.0 that include fixes for some security issues.
  • Extend Secure Desktop feature to smart card PIN entry dialog.
  • Fix truncated license text in installer wizard.
  • Add portable package that allows extracting binaries without asking for admin privileges.
  • Simplify format of language XML files.
  • Workaround for cases where password dialog doesn't get keyboard focus if Secure Desktop is not enabled.
• Linux:
  • Fix failure to install GUI version under recent versions of KDE.
  • Fix wxWidgets assertion failed when backing up/restoring volume header.
• MacOSX:
  • Fix issue preventing some local help files from opening in the browser.

1.21 (July 9^th, 2017):

• All OSs:
  • Fix 1.20 regression crash when running on CPU not supporting extended features.
• Windows:
  • Fix 1.20 regression that caused PIM value stored in favorites to be ignored during mount.
  • Fix 1.20 regression that causes system favorites not to mount in some cases.
  • Fix some cases of "Parameter Incorrect" error during EFI system encryption wizard.
  • Install PDF documents related to EFI system encryption configuration for advanced users:
    • disk_encryption_v1_2.pdf related to EFI hidden OS and full fisk encryption
    • dcs_tpm_owner_02.pdf related to TPM configuration for EFI system encryption.
• FreeBSD:
  • Add support for building on FreeBSD.

1.20 (June 29^th, 2017):

• All OSs:
  • Use 64-bit optimized assembly implementation of Twofish and Camellia by Jussi Kivilinna.
    • Camellia 2.5 faster when AES-NI supported by CPU. 30% faster without it.
  • Use optimized implementation for SHA-512/SHA256.
    • 33% speedup on 64-bit systems.
  • Deploy local HTML documentation instead of User Guide PDF.
  • Change links in UI from ones on Codeplex to ones hosted at veracrypt.fr
  • Security: build binaries with support for Address Space Layout Randomization (ASLR).
• Windows:
  • Several fixes and modifications for EFI System Encryption:
    • Fix bug in EFI system decryption using EFI Rescue Disk
    • Add support for TPM 1.2 and TPM 2.0 (experimental) through DCS low level configuration.
      • https://dc5.sourceforge.io/docs/dcs_tpm_owner_02.pdf
    • Add Support for EFI full disk encryption and hidden OS using manual procedure (not exposed in UI).
      • https://dc5.sourceforge.io/docs/disk_encryption_v1_2.pdf
  • Enable using Secure Desktop for password entry. Add preferences option and command line switch (/secureDesktop) to activate it.
  • Use default mount parameters when mounting multiple favorites with password caching.
  • Enable specifying PRF and TrueCryptMode for favorites.
  • Preliminary driver changes to support EFI hidden OS functionality.
  • Fix Streebog not recognized by /hash command line.
  • Add support for ReFS filesystem on Windows 10 when creating normal volumes
  • Fix high CPU usage when favorite configured to mount with VolumeID on arrival.
  • Use CHM file for User Guide instead of PDF.
  • Fix false warning in case of EFI system encryption about Windows not installed on boot drive.
  • Enhancements to driver handling of various disk IOCTL.
  • Enhancements to EFI bootloader. Add possibility to manually edit EFI configuration file.
  • Driver Security: Use enhanced protection of NX pool under Windows 8 and later.
  • Reduce performance impact of internal check for disconnected network drives.
  • Minor fixes.
• MacOSX:
  • OSX 10.7 or newer is required to run VeraCrypt.
  • Make VeraCrypt default handler of .hc & .tc files.
  • Add custom VeraCrypt icon to .hc and .tc files in Finder.
  • Check TrueCryptMode in password dialog when opening container file with .tc extension.
• Linux:
  • Check TrueCryptMode in password dialog when opening container file with .tc extension.
  • Fix executable stack in resulting binary which was caused by crypto assembly files missing the GNU-stack note.

1.19 (October 17^th, 2016):

• All OSs:
  • Fix issues raised by Quarkslab audit.
    • Remove GOST89 encryption algorithm.
    • Make PBKDF2 and HMAC code clearer and easier to analyze.
    • Add test vectors for Kuznyechik.
    • Update documentation to warn about risks of using command line switch ”tokenpin”.
  • Use SSE2 optimized Serpent algorithm implementation from Botan project (2.5 times faster on 64-bit platforms).
• Windows:
  • Fix keyboard issues in EFI Boot Loader.
  • Fix crash on 32-bit machines when creating a volume that uses Streebog as PRF.
  • Fix false positive detection of Evil-Maid attacks in some cases (e.g. hidden OS creation)
  • Fix failure to access EFS data on VeraCrypt volumes under Windows 10.
  • Fix wrong password error in the process of copying hidden OS.
  • Fix issues raised by Quarkslab audit:
    • Fix leak of password length in MBR bootloader inherited from TrueCrypt.
    • EFI bootloader: Fix various leaks and erase keyboard buffer after password is typed.
    • Use libzip library for handling zip Rescue Disk file instead of vulnerable XUnzip library.
  • Support EFI system encryption for 32-bit Windows.
  • Perform shutdown instead of reboot during Pre-Test of EFI system encryption to detect incompatible motherboards.
  • Minor GUI and translations fixes.
• MacOSX:
  • Remove dependency to MacFUSE compatibility layer in OSXFuse.

 

1.18a (August 17^th, 2016):

• All OSs:
  • Support Japanese encryption standard Camellia, including for Windows system encryption (MBR & EFI).
  • Support Russian encryption and hash standards Kuznyechik, Magma and Streebog, including for Windows EFI system encryption.
  • Fix TrueCrypt vulnerability allowing detection of hidden volumes presence (reported by Ivanov Aleksey Mikhailovich, alekc96 [at] mail dot ru)
    • To avoid hinting whether your volumes contain a hidden volume or not, or if you depend on plausible deniability when using hidden volumes/OS, then you must recreate both the outer and hidden volumes including system encryption and hidden OS, discarding existing volumes created prior to 1.18a version of VeraCrypt.
• Windows:
  • Support EFI Windows system encryption (limitations: no hidden os, no boot custom message)
  • Enhanced protection against dll hijacking attacks.
  • Fix boot issues on some machines by increasing required memory by 1 KiB
  • Add benchmarking of hash algorithms and PRF with PIM (including for pre-boot).
  • Move build system to Visual C++ 2010 for better stability.
  • Workaround for AES-NI support under Hyper-V on Windows Server 2008 R2.
  • Correctly remove driver file veracrypt.sys during uninstall on Windows 64-bit.
  • Implement passing smart card PIN as command line argument (/tokenpin) when explicitly mounting a volume.
  • When no drive letter specified, choose A: or B: only when no other free drive letter is available.
  • Reduce CPU usage caused by the option to disable use of disconnected network drives.
  • Add new volume ID mechanism to be used to identify disks/partitions instead of their device name.
  • Add option to avoid PIM prompt in pre-boot authentication by storing PIM value unencrypted in MBR.
  • Add option and command line switch to hide waiting dialog when performing operations.
  • Add checkbox in "VeraCrypt Format" wizard GUI to skip Rescue Disk verification during system encryption procedure.
  • Allow files drag-n-drop when VeraCrypt is running as elevated process.
  • Minor GUI and translations fixes.
• Linux:
  • Fix mount issue on Fedora 23.
  • Fix mount failure when compiling source code using gcc 5.x.
  • Adhere to XDG Desktop Specification by using XDG_CONFIG_HOME to determine location of configuration files.
• MacOSX:
  • Solve compatibility issue with newer versions of OSXFuse.

 

1.17 (February 13^th, 2016):

• All OSs:
  • Support UNICODE passwords: all characters are now accepted in passwords (except Windows system encryption)
  • Cut mount/boot time by half thanks to a clever optimization of key derivation (found by Xavier de Carné de Carnavalet)
  • Optimize Whirlpool PRF speed by using assembly (25% speed gain compared to previous code).
  • Add support for creating exFAT volumes.
  • Add GUI indicator for the amount of randomness gathered using mouse movement.
  • Include new icons and graphics contributed by Andreas Becker (http://www.andreasbecker.de)
• Windows:
  • Fix dll hijacking issue affecting installer that allows code execution with elevation of privilege (CVE-2016-1281). Reported by Stefan Kanthak (http://home.arcor.de/skanthak/)
  • Sign binaries using both SHA-1 and SHA-256 to follow new Microsoft recommendations.
  • Solve issues under Comodo/Kaspersky when running an application from a VeraCrypt volume (Reported and fixed by Robert Geisler).
  • Bootloader: Protect password/PIM length by filling the fields to maximum length with '*' after ENTER
  • Solve issue with system favorites not being able to be mounted to drive A:
  • Solve lost focus issues for after displaying the waiting dialog
  • Solve rare issue where some partitions where asscoiated with wrong disk the "Select Device" dialog.
  • Implement PIM caching, for both system encryption and normal volumes. Add option to activate it.
  • Don't try mounting using cached passwords if password and/or keyfile are specified in the command line.
  • Internal rewrite to make VeraCrypt native UNICODE application.
  • Workaround to avoid false positive detection by some anti-virus software.
  • Hide disconnected network drives in the list of available drives. Add option to make them available for mounting.
  • Solve issue that caused in some cases configuration and history XML files to be updated even when not needed.
  • Fix leak of path of selected keyfiles in RAM.
  • Fix TB unit can't be deselected in VeraCryptExpander.
  • Add Alt+i keyboard shortcut for "Use PIM" checkbox in GUI.
  • Minor GUI and translations fixes.
• Linux/MacOSX:
  • Fix issue of --stdin option not handling correctly passwords that contain a space character (reported and fixed by Codeplex user horsley1953).
  • Fix issue creating volumes using command line with a filesystem other than FAT.
  • Support K/M/G/T suffixes for --size switch to indicate unit to use for size value.

1.16 (October 7^th, 2015):

• Windows:
  • Modify patch for CVE-2015-7358 vulnerability to solve side effects on Windows while still making it very hard to abuse drive letter handling.
  • Fix failure to restore volume header from an external file in some configurations.
  • Add option to disable “Evil Maid” attack detection for those encountering false positive cases (e.g. FLEXnet/Adobe issue).
  • By default, don’t try to mount using empty password when default keyfile configured or keyfile specified in command line. Add option to restore the old behavior.
    • If mounting using empty password is needed, explicitly specify so in the command line using: /p ""

1.15 (September 26^th, 2015):

• Windows:
  • Fix two TrueCrypt vulnerabilities reported by James Forshaw (Google Project
    Zero)
    • CVE-2015-7358 (critical): Local Elevation of Privilege on Windows by
      abusing drive letter handling.
    • CVE-2015-7359: Local Elevation of Privilege on Windows caused by
      incorrect Impersonation Token Handling.
  • Fix regression in mounting of favorite volumes at user logon.
  • Fix display of some Unicode languages (e.g. Chinese) in formatting wizard.
  • Set keyboard focus to PIM field when "Use PIM" is checked.
  • Allow Application key to open context menu on drive letters list
  • Support specifying volumes size in TB in the GUI (command line already supports this)

1.14 (September 16^th, 2015):

• All OSs:
  • Mask and unmask PIM value in GUI and bootloader like the password.

• Windows:
  • Solve Rescue Disk damaged error when using cascade ciphers and SHA256 for system encryption.
  • Solve option "Cache password in drive memory" always disabled even if checked in preferences.
  • Solve UI language change not taken into account for new install unless a preference is changed.
  • Implement creating file containers using command line.
  • Driver: disable support of IOCTL_STORAGE_QUERY_PROPERTY by default and add option to enable it.
  • Driver:  Support returning StorageDeviceProperty when queried through IOCTL_STORAGE_QUERY_PROPERTY.
  • Support setting volume label in Explorer through mount option or favorite label value.
  • Fix for Hot Keys assignment dialog issue where OEM-233 is always displayed and can't be changed.
  • Always copy both 32-bit and 64-bit executable binaries during install and in Traveler Disk Setup.
    • Traveler Disk will again use 32-bit exe by default while also offering 64-bit exe.
    • On Windows 64-bit, 32-bit exe files are now available(e.g. if needed to use 32-bit PKCS#11 dll)
  • Include Volume Expander in Traveler Disk Setup.
  • Don't offer creating a restore point if it is disabled in Windows.
  • Add possibility to verify a Rescue Disk ISO image file.
  • Minors fixes in the installer, GUI and driver.

• Linux:
  • Support supplying password using stdin in non interactive mode (contributed by LouisTakePILLz)
    • Example: veracrypt -t ${IMAGE_PATH} ${MOUNT_PATH} --mount --non-interactive --stdin <<< "$PWD"

1.13 (August 9^th, 2015):

• Windows:
  • Solve TOR crashing when run from a VeraCrypt volume.

1.12 (August 5^th, 2015):

• All OSs:
  • Implement "Dynamic Mode" by supporting a Personal Iterations Multiplier (PIM). See documentation for more information.

• Windows:
  • Detect Boot Loader tampering ("Evil Maid" attacks) for system encryption and propose recovery options.
  • Fix buffer overrun issue and other memory related bugs when parsing language XML files.
  • Fix wrongly reported bad sectors by chkdsk caused by a bug in IOCTL_DISK_VERIFY handling.
  • Fix privacy issue caused by configuration and history files being updated whenever VeraCrypt is used (reported by Liran Elharar)
  • Fix system favorites not always mounting after cold start.
  • Solve installer error when updating VeraCrypt on Windows 10.
  • Implement decryption of non-system partition/drive.
  • Include 64-bit exe files in the installer and deploy them on 64-bit machines for better performances.
  • Allow using drive letters A: and B: for mounting volumes
  • Make command line argument parsing more strict and robust (e.g. /lz rejected, must be /l z)
  • Add possibility to show system encryption password in Windows GUI and bootloader
  • Solve "Class Already exists" error that was happening for some users.
  • Solve some menu items and GUI fields not translatable
  • Make volumes correctly report Physical Sector size to Windows.
  • Correctly detect switch user/RDP disconnect operations for autodismount on session locked.
  • Add manual selection of partition when resuming in-place encryption.
  • Add command line option (/cache f) to temporarily cache password during favorites mounting.
  • Add waiting dialog for Auto-Mount Devices operations to avoid freezing GUI.
  • Add extra information to displayed error message in order to help analyze reported issues.
  • Disable menu entry for changing system encryption PRF since it's not yet implemented.
  • Fix failure to change password when UAC required (inherited from TrueCrypt)
  • Minor fixes and changes (see Git history for more details)

• Linux:
  • Solve installer issue under KDE when xterm not available
  • Fix warnings on about/LegalNotice dialogs when wxWidgets linked dynamically (N/A for official binary)
  • Support hash names with '-' in command line (sha-256, sha-512 and ripemd-160)
  • Remove "--current-hash" switch and add "--new-hash" to be more coherent with existing switches.
  • When only keyfile specified in command line, don't try to mount using empty password.
    • If mounting using empty password is needed, explicitly specify so using: -p ""

1.0f-2(April 5^th, 2015):

• All OSs:
  • Mounting speed improvement, up to 20% quicker on 64-bit (contributed by Nils Maier)
  • Add option to set default hash/TrueCryptMode used for mounting volumes.
  • Use TrueCryptMode/Hash specified in command line in password dialog.
• Windows:
  • Solve CryptAcquireContext vulnerability reported by Open Crypto Audit Phase II.
  • Proper handling of random generator failures. Inform user in such cases.
  • TrueCrypt Mode related changes:
    • Support mounting TrueCrypt system partition (no conversion yet)
    • Support TrueCrypt volumes as System Favorites.
    • Correct displaying wrong TrueCrypt mode in volume properties when SHA-256 is used.
  • Solve PIN BLOCKED issue with smart cards in a special case.
  • Correctly handle file access errors when mounting containers.
  • Solve several issues reported by the Static Code Analysis too Coverity.
  • Bootloader: Add "Verifying Password..." message.
  • When UAC prompt fails (for example timeout), offer the user to retry the operation.
  • Uninstall link now open the standard "Add/Remove Programs" window.
  • On uninstall, remove all VeraCrypt references from registry and disk.
  • Included VeraCryptExpander in the Setup.
  • Add option to temporary cache password when mounting multiple favorites.
  • Minor fixes and enhancements (see git history for more information)
• MacOSX:
  • Solve issue volumes not auto-dismounting when quitting VeraCrypt.
  • Solve issue VeraCrypt window not reopening by clicking dock icon.
• Linux/MacOSX:
  • Solve preferences dialog not closing when clicking on the 'X' icon.
  • Solve read-only issue when mounting non-FAT volumes in some cases.
  • Support opening/exploring mounted volumes on desktops other than Gnome/KDE.
  • Solve various installer issues when running on less common configurations
  • Minor fixes (see git history for more information)

1.0f-1 (January 4^th, 2015)

• All OSs:
  • Add support for old TrueCrypt 6.0.
  • Change naming of cascades algorithms in GUI for a better description.
• Linux/MacOSX:
  • Make cancel button of the preference dialog working.
  • Solve impossibility to enter a one digit size for the volume.
  • Add wait dialog to the benchmark calculation.
• Windows:
  • Add TrueCrypt mode to the mounted volume information.
  • For Windows XP, correct the installer graphical artefacts.

1.0f (December 30, 2014)

• All OSs:
  • Add support for mounting TrueCrypt volumes.
  • Add support for converting TrueCrypt containers and non-system partitions.
  • Add support for SHA-256 for volume encryption.
  • Make SHA-512 the default key derivation algorithm and change the order of preference of derivation algorithms : SHA-512 -> Whirlpool -> SHA-256 -> RIPEMD160
  • Deprecate RIPEMD160 for non-system encryption.
  • Speedup mount operation by enabling choice of correct hash algorithm.
  • Display a wait dialog during lengthy operations to avoid freezing the GUI.
  • Implement creation of multiple keyfiles at once, with predefined or random size.
  • Always display random gathering dialog before performing sensitive operations.
  • Links in the application now points to the online resources on Codeplex
  • First version of proper VeraCrypt User Guide
• MacOSX:
  • Implement support for hard drives with a large sector size (> 512).
  • Link against new wxWidgets version 3.0.2.
  • Solve truncated text in some Wizard windows.
• Linux:
  • Add support of NTFS formatting of volumes.
  • Correct issue on opening of the user guide PDF.
  • Better support for hard drives with a large sector size (> 512).
  • Link against new wxWidgets version 3.0.2.
• Windows:
  
  • Security: fix vulnerability in bootloader detected by Open Crypto Audit and make it more robust.
  • Add support for SHA-256 in system boot encryption.
  • Various optimizations in bootloader.
  • Complete fix of ShellExecute security issue.
  • Kernel driver: check that the password length received from bootloader is less or equal to 64.
  • Correct a random crash when clicking the link for more information on keyfiles
  • Implement option to auto-dismount when user session is locked
  • Add self-test vectors for SHA-256
  • Modern look-and-feel by enabling visual styles
  • few minor fixed.