Encrypted Containers with VeraCrypt

VeraCrypt was created after TrueCrypt was discontinued in 2014 under mysterious circumstances. VeraCrypt is a fork with significant security improvements: increased iteration count for volume header key derivation (tens of thousands vs a few hundred in TrueCrypt), making brute force attacks much harder. An independent security audit (OSTIF, 2016) found no critical vulnerabilities in VeraCrypt.

A VeraCrypt standard volume is a container file of any size stored on a filesystem. To create one: open VeraCrypt, click Create Volume, select Create an encrypted file container, choose the volume location and size, select algorithms, set a password, and format. The resulting file appears as random data to anyone without the password. It can be moved, copied, or backed up like any file.

VeraCrypt offers multiple encryption options: AES-256, Serpent, Twofish, and cascades (AES-Twofish-Serpent). AES-256 with XTS mode is the recommended choice for most users: hardware-accelerated on modern CPUs via AES-NI, extensively analyzed, and no known practical weaknesses. Cascades provide extra security margin but are significantly slower. XTS mode is designed specifically for disk encryption, handling sectors independently.

VeraCrypt uses a key derivation function (KDF) to derive the volume encryption key from your password. Options include PBKDF2-RIPEMD-160, PBKDF2-SHA-512, Whirlpool, and Argon2id (added recently). SHA-512 or Argon2id are the modern recommendations: they are memory-hard and compute-intensive, making offline brute force attacks extremely expensive even against short passwords.

Mounting a VeraCrypt volume makes it accessible as a virtual drive. VeraCrypt performs the key derivation from your password, decrypts the volume header to recover the master key, and maps the container as a filesystem. Files written to the mounted drive are encrypted on the fly. Dismounting removes the mapping, and the container file returns to appearing as random data.

VeraCrypt's core capability is transparent on-the-fly encryption. When you write a file to a mounted VeraCrypt volume, it is encrypted in memory before being written to the container file. When you read a file, it is decrypted as it is read. Applications using the mounted volume see a normal filesystem; they have no knowledge of the encryption layer operating beneath them.

VeraCrypt supports hidden volumes inside standard volumes. The outer volume has one password that reveals innocuous content. A hidden volume occupies unused space in the outer volume and has a different password revealing sensitive content. When forced to reveal a password, you can provide the outer password. There is cryptographically no way to prove a hidden volume exists, providing plausible deniability.

VeraCrypt can create a hidden operating system partition for extreme plausible deniability. The outer system partition contains a decoy OS that boots normally and appears legitimate. The hidden partition contains the real sensitive OS. Booting with one password reveals the decoy; booting with another reveals the real system. Implementation requires specific partition layout and a careful setup process.

Before creating a volume, the VeraCrypt benchmark tool measures encryption throughput for all supported algorithm combinations on your hardware. This helps select between single algorithms and cascades with realistic performance expectations. On a modern CPU with AES-NI, AES-256-XTS typically achieves over 3 GB/s, making it imperceptible for normal file access. Cascades may be 3-5x slower.

VeraCrypt can encrypt the entire system partition, including the operating system. Before Windows boots, the VeraCrypt bootloader (stored in the MBR or EFI partition) prompts for the password. After correct entry, the bootloader decrypts the Windows partition and hands off to the OS. This protects against physical attacks where an attacker removes the drive or boots from external media.

The 2016 OSTIF/Quarkslab audit of VeraCrypt identified 8 vulnerabilities: 1 critical (in the bootloader, affecting full-disk encryption), 3 medium, and 4 low severity. VeraCrypt developers patched all issues promptly. The audit confirmed no backdoors and found the hidden volume implementation cryptographically sound. This public audit significantly increased trust in VeraCrypt as a TrueCrypt replacement.

What is the purpose of a VeraCrypt hidden volume?

VeraCrypt recap: TrueCrypt successor with security improvements and a clean audit result, create container files as encrypted volumes, AES-256-XTS recommended for performance and security, SHA-512 or Argon2id for key derivation, on-the-fly encryption makes encryption transparent to applications, hidden volumes provide plausible deniability, and system partition encryption protects the OS from physical attacks.