This project has moved and is read-only. For the latest updates, please go here.

Documentation Clarification in Header Key Derivation, Salt, and Iteration Count


Hello Mounir,

I have been trying to understand how the header key is created and encrypted reading the Header Key Derivation, Salt, and Iteration Count, Encryption Scheme, Modes of Operation and VeraCrypt Volume Format Specification.

To me, it appears the Header Key Derivation, Salt, and Iteration Count documentation is incomplete by failing to explain the encryption of the volume header for single cipher and cascade ciphers. Also, how does the secondary header key unlock the encrypted cipher of the volume header if the primary is damaged?

The documentation's example of AES-Twofish-Serpent cascade says that one "768-bit header key is then split into three 256-bit keys out of which the first key is used by Serpent, the second key is used by Twofish, and the third by AES".

However, there is only one volume header correct?

As you can tell, I am confused at this point.

There is no information in the documentation how the volume header is encrypted and decrypted for either single cipher or cascade scenarios and what role the primary & secondary header keys play in encrypting/decrypting the volume header. (Or maybe it does and I just do not understand it.)

Can the Header Key Derivation documentation be modified to help explain the above?

Kind Regards,