Documentation for advanced DCS features (picture password, TPM, hidden OS, ...)

[kFYatek]

I took the liberty of writing my own documentation, with step-by-step guides, for all those features that have been in the codebase since 2017, but never integrated with the GUI, and only barely documented with those cryptic PDF files written by @kavsrf and other community efforts on Sourceforge.

Here are my documentation efforts: https://github.com/kFYatek/veracrypt-missing-docs/

I'm mostly just putting it out, but if you want to link to it from any official resources, or incorporate it therein, feel free to do so in any way you feel appropriate. If you want me to remake it into a pull request for example, I'd be glad for some guidelines on that.

[kavsrf]

@kFYatek thank you for good docs! It is very useful!

Note: To create more consistent docs and sources of DCS project use asciidoc format. It can make the documentation part of the sources via references and asciidoc tags.

[kFYatek]

@kavsrf Thanks, and thanks for your original work on these features!

TBH I don't really see how what I what I wrote could be meaningfully integrated into the sources. It's much higher level than that, except a couple of specific places. Do you think otherwise? Where do you think those references and tags could be useful?

[kavsrf]

Main idea is to create documentation part of sources. It helps to keep code and docs consistent.

General overview and concepts is top-level document. The document includes parts from sources (comments or real code) to clarify some topics.

asciidoctor format very close to markdown but there are several useful improvements e.g. include with tags.

Places to use e.g. dcscfg switches parser and dcsprop parser (need docs inside with tags).

[TraceNChase]

What what, TPM is supported, I remember reading official documentation that it was not... , always thought that decision was strange, could be wrong, but thanks for guide mate!
Anyone know if Verycrypt runs fast on SSD's , I seem to remember that It procured slow SSD speeds before, the reason I switched to Disckryptor, .. but I hardly ever used Windows anymore but still interested

[kFYatek]

@TraceNChase

What what, TPM is supported, I remember reading official documentation that it was not... , always thought that decision was strange, could be wrong, but thanks for guide mate!

I believe that the original authors of TrueCrypt and VeraCrypt rejected the TPM for the reasons described in the official docs. Support for it has been added to the UEFI bootloader which is almost a separate piece of software.

Either way, I'd be careful with using the TPM integration. Besides the considerations for using the TPM in general, it also doesn't follow the standard practices:

• The TPM part of the key is stored as an NV rather than the Create/Unseal process that is used by BitLocker, systemd-cryptenroll etc. Using the Unseal process means that the TPM part of the protection cannot be read by itself under any circumstances (other than a bug in the TPM implementation) - not the case with VeraCrypt-DCS.
• Said NV has read/write permissions for the TPM owner, which is why setting the owner password is absolutely essential. TBH I have no idea why that is, I think that the owner read permission especially makes absolutely no sense - it just pointlessly creates a parallel way of retrieving the TPM part of the key, which creates a possible attack vector while serving no real purpose. @kavsrf, you wrote that code, is there a reason why this owner read permision exists? (for TPM 2.0 at least, I don't really understand TPM 1.2)
• The TPM and password parts of the key are combined by means of bytewise sum of partial CRC32 sums, which... I don't know, I'm not a cryptologist so maybe I'm too paranoid for no reason, but it doesn't sound like the most cryptographically sound way of combining keying information.

Like I mentioned, I have no real credentials in the world of cybersecurity, so maybe I'm misunderstanding something, maybe these issues don't really matter. But it's different to how every other "serious" solution uses the TPM, so I'd at least be cautious, especially if your goal is transparent, unattended operation (which has its own issues regardless of implementation anyway, read about cold boot attacks).

Anyone know if Verycrypt runs fast on SSD's , I seem to remember that It procured slow SSD speeds before, the reason I switched to Disckryptor, .. but I hardly ever used Windows anymore but still interested

I've heard different, contradictory reports, so it probably depends a lot on other components of your system. I used VeraCrypt for a couple of years on my old laptop with a SATA SSD and didn't feel like the performance was lacking, but also I never truly measured it.

If you're using a top-of-the-line NVMe drive and want to retain its performance, you may be disappointed. There are some tuneup settings that you can play with to try to increase the performance, see the changelog for 1.25.7 for details. Your mileage may vary, there's no saying for sure - although I also think that DiskCryptor is generally considered to be faster overall.

[kavsrf]

• Said NV has read/write permissions for the TPM owner, which is why setting the owner password is absolutely essential. TBH I have no idea why that is, I think that the owner read permission especially makes absolutely no sense - it just pointlessly creates a parallel way of retrieving the TPM part of the key, which creates a possible attack vector while serving no real purpose. @kavsrf, you wrote that code, is there a reason why this owner read permision exists? (for TPM 2.0 at least, I don't really understand TPM 1.2)

TPM 1.2 logic works the same.

DCS tries to keep maximum flexibility for any usage scenarios.

The TPM role is to measure and keep integrity (software binaries, firmware, and configurations). Secure boot improvement.

TPM owner with password access - TPM owner can modify the NV region if required by usage scenario, Extra flexibility. Agree - If software share the password, it is not good.

To decrypt key container it is possible to create parts:

1. Password+PIM
2. Platform serials and TPM NV (to lock password+pim to the hardware)
3. Store disk key to separate USB + USB serial, (remove the key from disk protected)

Note: There were no requests to improve TPM support – so it works as is…