Keyfiles
VeraCrypt keyfile is a file whose content is combined with a password. The user can use any kind
of file as a VeraCrypt keyfile. The user can also generate a keyfile using the built-in keyfile
generator, which utilizes the VeraCrypt RNG to generate a file with random content (for more
information, see the section Random Number Generator).
The maximum size of a keyfile is not limited; however, only its first 1,048,576 bytes (1 MB) are
processed (all remaining bytes are ignored due to performance issues connected with processing
extremely large files). The user can supply one or more keyfiles (the number of keyfiles is not
limited).
Keyfiles can be stored on PKCS-11-compliant [23] security tokens and smart cards protected by
multiple PIN codes (which can be entered either using a hardware PIN pad or via the VeraCrypt
GUI).
Keyfiles are processed and applied to a password using the following method:
1. Let P be a VeraCrypt volume password supplied by user (may be empty)
2. Let KP be the keyfile pool
3. Let kpl be the size of the keyfile pool KP, in bytes (64, i.e., 512 bits);
kpl must be a multiple of the output size of a hash function H
4. Let pl be the length of the password P, in bytes (in the current version: 0 pl 64)
5. if kpl > pl, append (kpl – pl) zero bytes to the password P (thus pl = kpl)
6. Fill the keyfile pool KP with kpl zero bytes.
7. For each keyfile perform the following steps:
a. Set the position of the keyfile pool cursor to the beginning of the pool
b. Initialize the hash function H
c. Load all bytes of the keyfile one by one, and for each loaded byte perform the
following steps:
i. Hash the loaded byte using the hash function H without initializing the hash,
to obtain an intermediate hash (state) M. Do not finalize the hash (the state is
retained for next round).
ii. Divide the state M into individual bytes.
For example, if the hash output size is 4 bytes, (T
0
|| T
1
|| T
2
|| T
3
) = M
iii. Write these bytes (obtained in step 7.c.ii) individually to the keyfile pool with
the modulo 2
8
addition operation (not by replacing the old values in the pool)
at the position of the pool cursor. After a byte is written, the pool cursor
position is advanced by one byte. When the cursor reaches the end of the
pool, its position is set to the beginning of the pool.
8. Apply the content of the keyfile pool to the password P using the following method:
a. Divide the password P into individual bytes B
0
...B
pl-1
.
Note that if the password was shorter than the keyfile pool, then the password was padded with zero
bytes to the length of the pool in Step 5 (hence, at this point the length of the password is always
greater than or equal to the length of the keyfile pool).
b. Divide the keyfile pool KP into individual bytes G
0
...G
kpl-1
c.
For 0 i kpl perform: B
i
= B
i
G
i
d. P = B
0
|| B
1
|| ... || B
pl-2
|| B
pl-1
