Header Key Derivation, Salt, and Iteration Count

Header key is used to encrypt and decrypt the encrypted area of the VeraCrypt volume header (for system encryption, of the keydata area), which contains the master key and other data (see the sections Encryption Scheme and VeraCrypt Volume Format Specification). In volumes created by VeraCrypt (and for system encryption), the area is encrypted in XTS mode (see the section Modes of Operation). The method that VeraCrypt uses to generate the header key and the secondary header key (XTS mode) is PBKDF2, specified in PKCS #5 v2.0; see [7].

512-bit salt is used, which means there are 2⁵¹² keys for each password. This significantly decreases vulnerability to 'off-line' dictionary/'rainbow table' attacks (pre-computing all the keys for a dictionary of passwords is very difficult when a salt is used) [7]. The salt consists of random values generated by the VeraCrypt random number generator during the volume creation process. The header key derivation function is based on HMAC-SHA-512, HMAC-SHA-256, HMAC-BLAKE2S-256, HMAC-Whirlpool or HMAC-Streebog (see [8, 9, 20, 22]) – the user selects which. The length of the derived key does not depend on the size of the output of the underlying hash function. For example, a header key for the AES-256 cipher is always 256 bits long even if HMAC-SHA-512 is used (in XTS mode, an additional 256-bit secondary header key is used; hence, two 256-bit keys are used for AES-256 in total). For more information, refer to [7]. A large number of iterations of the key derivation function have to be performed to derive a header key, which increases the t