[flatstik]

Linux and macOS part of #1969 (see #1815 and #1831 for the same cost path).

When a volume is mounted with an empty password, every cached password is tried with the selected KDF, or with autodetection, which also tries Argon2. Above PIM 31, Argon2 uses 1 GiB and its passes grow with the PIM, so each cached password that does not belong to the volume took minutes.

The cache now keeps with each password the KDFs it opened volumes with. Passwords are tried from the most recently used, each one before the next, so an older password cannot open an outer volume ahead of the newer password of its hidden volume. With autodetection, a password is tried with its remembered PBKDF2 KDFs, then the other PBKDF2 KDFs, then full autodetection only if it opened an Argon2 volume or one with an unknown KDF; otherwise the user is asked for the password. An explicitly selected KDF is still used for all cached passwords, once each.

A different, newer Argon2 password still costs its derivations before an older password is tried (122 s at PIM 100 in my measurement), which by my reading of the code master pays too; I did not run master. An allocation failure does not stop the search.

The Windows driver cache (src/Common/Cache.c) has the same problem and is not changed here; I cannot test Windows or macOS.

Tested with three volumes (SHA-512, A and C share a password, B has another), mounted as favorites in one run with password caching, typing only the passwords of A and B:

• Tests/test_password_cache_kdf.py (new, PIM 100, run in the Linux workflow): with this change the run takes 1.8 s (ubuntu-24.04) and 2.1 s (ubuntu-26.04), against 0.4 to 0.5 s for one mount; on unchanged master it takes 173 s and the test fails. Runs on my fork: https://github.com/flatstik/VeraCrypt/actions/runs/40508100174 (this change), https://github.com/flatstik/VeraCrypt/actions/runs/40508103148 (master with only the test).
• The same test checks that the newer password opens the hidden volume, not the older one the outer volume: passes on both, with about 10 s for the favorites run after the priority change, https://github.com/flatstik/VeraCrypt/actions/runs/42407405714. The 1.8 s figures above are from before that change.
• Debian 13 x86_64 under QEMU, PIM 32, before the priority change: 19 s with this change, 1846 s without (one mount: 4 s). In both, C is mounted from the cache without a prompt.

[idrassi]

Thanks for investigating this and putting together a reproducible case. I have noted inline the issues I see.

Before revising the implementation, I would like us to settle what should happen when the quick attempts don't find a match. Preserving full autodetection means an unknown Argon2 volume may still need an expensive attempt. Simply adding a full retry at the end would bring back the original worst case. We need a deliberate choice about when to ask the user for input and when to continue searching.

[flatstik]

Thanks for the review. The test now dismounts only its own volumes and keeps its files if that fails (4ef4ad1); the implementation is unchanged until we settle the behaviour. A proposal:

1. The remembered KDF only orders the attempts. Every cached password is still tried with all PBKDF2 KDFs (so a password cached from a SHA-512 volume still opens a SHA-256 volume), with derivation failures handled as in autodetection rather than through an explicit Kdf.
2. First pass: all cached passwords with the PBKDF2 KDFs only, each with its remembered KDF first; entries learned with a PBKDF2 KDF before entries learned with Argon2.
3. Argon2 is attempted only for cached passwords whose entry was learned with Argon2 (at most one entry per password and KDF, without moving an Argon2 association ahead of a PBKDF2 one for the same password).
4. If nothing matches, the user is asked for the password instead of trying Argon2 with the remaining cached passwords. An Argon2 volume whose password is cached only from PBKDF2 volumes then needs the password once, after which its entry knows Argon2.

This bounds the cost of a cache miss to PBKDF2 derivations, plus Argon2 only for passwords that have been used with Argon2. Excluding Argon2 from an autodetection attempt needs a new mount option for the core service; I would add it like MountVolumeRequestV2, so that an older service rejects the request instead of ignoring the option.

Would this be acceptable, or would you rather keep full autodetection for some case in step 4 (for example the most recent entry)?

[flatstik]

Updated in 24a3019, which settles the question in the code rather than through a protocol change:

• With autodetection, each cached password is tried with the KDF it opened a volume with, then with the other PBKDF2 KDFs. Argon2 is tried only for passwords that opened an Argon2 volume, or a volume with an unknown KDF, through autodetection.
• If nothing matches, the user is asked for the password instead of trying Argon2 with every cached password. An Argon2 volume whose password is cached only from PBKDF2 volumes needs it once; afterwards its entry is known as Argon2.
• No new mount option is needed, contrary to what I wrote above: the attempts are made by the proxy, with an explicit PBKDF2 KDF or with autodetection.

The extra PBKDF2 attempts are made one at a time, so a cache miss costs more than before this PR's first version: in the test (PIM 100, three favorites) about 10 s instead of 2 s, against 173 s on master with Argon2. https://github.com/flatstik/VeraCrypt/actions/runs/40772767313

[Copilot]

🟡 Changes recommended

Cached-password attempts can prioritize an older outer-volume password over a newer hidden-volume password, risking a writable mount without hidden-volume protection and consequent hidden-data corruption.

6 open issues

• Preserve cached-password priority across KDF fallbacks · New
• Parse quoted mount paths without splitting on whitespace · New
• Deduplicate cached passwords by selected KDF · New
• Retry other KDFs for system-partition credential failures · New
• Record the resolved KDF after cached mounts · New
• Keep cache capacity per distinct password · New

What changed in this PR

Reduces slow Unix cached mounts associated with #1969 by recording each password’s KDF and avoiding unrelated, expensive Argon2 attempts.

Changes:

• Stores password/KDF pairs and prioritizes known KDFs during cached mounts.
• Retains explicitly selected KDFs and cross-KDF PBKDF2 fallback.
• Adds a Linux regression test for cached cross-KDF mounts and high-PIM performance.

File	Description
Tests/​test_password_cache_kdf.py	Checks cached mounts, password prompts, and timing across three volumes.
src/​Volume/​VolumePasswordCache.h	Defines cache entries containing a password and its KDF.
src/​Volume/​VolumePasswordCache.cpp	Stores and copies password/KDF associations.
src/​Core/​Unix/​CoreServiceProxy.h	Schedules cached KDF attempts and records detected KDFs.
.github/​workflows/​build-linux.yml	Adds regression-test triggers and execution to Linux package checks.

_{Review effort: Max}