Conversation
|
Thank you. Concering the implementation, I would not use CRT srand/rand. I prefer to use more secure alternative (like RtlGenRandom) |
|
This change leaves the choice of algorithm to the user. Many people just don't make any choice, and make it easy for attackers to attack. As for RtlGenRandom - I think in this case, srand does not affect security. |
|
I found another confirmation that attackers are using default values to crack VeraCrypt: I think I've found a compromise solution: maybe just add a text warning that the default values used help the attacker? |
Removed the default values for the algorithms. The default values attack first.
https://blog.elcomsoft.com/2021/06/breaking-veracrypt-obtaining-and-extracting-on-the-fly-encryption-keys/