VerCrypt 1.23

VeraCrypt is now compatible with default EFI SecureBoot configuration for system encryption.
Fix EFI system encryption issues on some machines (e.g. HP, Acer).
Support EFI system encryption on Windows LTSB.
Add compatibility of system encryption with Windows 10 upgrade using ReflectDrivers mechanism
Make EFI Rescue Disk decrypt partition correctly when Windows Repair overwrites first partition sector.
Add Driver option in the UI to explicitly allow Windows 8.1 and Windows 10 defragmenter to see VeraCrypt encrypted disks.
Add internal verification of binaries embedded signature to protect against some types to tampering attacks.
Fix Secure Desktop not working for favorites set to mount at logon on Windows 10 under some circumstances.
When Secure Desktop is enabled, use it for Mount Options dialog if it is displayed before password dialog.
When extracting files in Setup or Portable mode, decompress zip files docs.zip and Languages.zip in order to have ready to use configuration.
Display a balloon tip warning message when text pasted to password field is longer than maximum length and so it will be truncated.
Implement language selection mechanism at the start of the installer to make easier for international users.
Add check on size of file container during creation to ensure it's smaller than available free disk space.
Fix buttons at the bottom not shown when user sets a large system font under Window 7.
Fix compatibility issues with some disk drivers that don't support IOCTL_DISK_GET_DRIVE_GEOMETRY_EX ioctl.

All OSs:
SIMD speed optimization for Kuznyechik cipher implementation (up to 2x speedup).
Add 5 new cascades of cipher algorithms: Camellia-Kuznyechik, Camellia-Serpent, Kuznyechik-AES, Kuznyechik-Serpent-Camellia and Kuznyechik-Twofish.
Windows:
MBR Bootloader: Fix failure to boot hidden OS on some machines.
MBR Bootloader: Reduce CPU usage during password prompt.
Security enhancement: Add option to block TRIM command for system encryption on SSD drives.
Implement TRIM support for non-system SSD drives and add option to enable it (TRIM is disabled by default for non-system volumes).
Better fix for "Parameter Incorrect" issues during EFI system encryption in some machines.
Driver: remove unnecessary dependency to wcsstr which can cause issues on some machines.
Driver: Fix "Incorrect Parameter" error when mounting volumes on some machines.
Fix failure to mount system favorites during boot on some machines.
Fix current application losing focus when VeraCrypt is run in command line with /quit /silent switches.
Fix some cases of external applications freezing during mount/dismount.
Fix rare cases of secure desktop for password dialog not visible which caused UI to block.
Update libzip to version 1.5.0 that include fixes for some security issues.
Extend Secure Desktop feature to smart card PIN entry dialog.
Fix truncated license text in installer wizard.
Add portable package that allows extracting binaries without asking for admin privileges.
Simplify format of language XML files.
Workaround for cases where password dialog doesn't get keyboard focus if Secure Desktop is not enabled.
Linux:
Fix failure to install GUI version under recent versions of KDE.
Fix wxWidgets assertion failed when backing up/restoring volume header.
MacOSX:
Fix issue preventing some local help files from opening in the browser.

Changes
All OSes:
Fix 1.20 regression causing crash when running on a CPU supporting SSE2 but not SSSE3.
Windows:
Fix 1.20 regression that caused PIM value stored in favorites to be ignored during mount.
Fix some cases of "Parameter Incorrect" error during EFI system encryption wizard.

# All OSes:
- Fix issues raised by Quarkslab audit.
> Remove GOST89 encryption algorithm.
> Make PBKDF2 and HMAC code clearer and easier to analyze.
> Add test vectors for Kuznyechik.
> Update documentation to warn about risks of using command line switch ”tokenpin”.
- Use SSE2 optimized Serpent algorithm implementation from Botan project (2.5 times faster on 64-bit platforms).
# Windows:
- Fix keyboard issues in EFI Boot Loader.
- Fix crash on 32-bit machines when creating a volume that uses Streebog as PRF.
- Fix false positive detection of Evil-Maid attacks in some cases (e.g. hidden OS creation)
- Fix failure to access EFS data on VeraCrypt volumes under Windows 10.
- Fix wrong password error in the process of copying hidden OS.
- Fix issues raised by Quarkslab audit:
> Fix leak of password length in MBR bootloader inherited from TrueCrypt.
> EFI bootloader: Fix various leaks and erase keyboard buffer after password is typed.
> Use libzip library for handling zip Rescue Disk file instead of vulnerable XUnzip library.
- Support EFI system encryption for 32-bit Windows.
- Perform shutdown instead of reboot during Pre-Test of EFI system encryption to detect incompatible motherboards.
- Minor GUI and translations fixes.
# MacOSX:
- Remove dependency to MacFUSE compatibility layer in OSXFuse.

# All OSs:
* Support Japanese encryption standard Camellia, including for Windows system encryption (MBR & EFI).
* Support Russian encryption and hash standards Kuznyechik, Magma and Streebog, including for Windows EFI system encryption.
# Windows:
* Support of EFI system encryption (limitatations: no hidden os, no boot custom message)
* Fix TrueCrypt vulnerability that enables detection of presence of hidden volumes
* Add support for Japanese encryption standard Camellia, including for system encryption.
* Add support for Russian encryption and hash standards Kuznyechik, Magma and Streebog including for EFI system encryption.
* Add benchmarking of hash algorithms and PRF with PIM (including for pre-boot).
* Move build system to Visual C++ 2010 for better stability.
* Fix boot issues on some machines by increasing required memory by 1 KiB
* Workaround for AES-NI support under Hyper-V on Windows Server 2008 R2.
* Enhanced protection against dll hijacking attacks.
* Correctly remove driver file veracrypt.sys during uninstall on Windows 64-bit.
* Implement passing smart card PIN as command line argument (/tokenpin) when explicitly mounting a volume.
* When no drive letter specified, choose A: or B: only when no other free drive letter is available.
* Reduce CPU usage caused by the option to disable use of disconnected network drives.
* Add new volume ID mechanism to be used to identify disks/partitions instead of their device name.
* Add option to avoid PIM prompt in pre-boot authentication by storing PIM value unencrypted in MBR.
* Add option and command line switch to hide waiting dialog when performing operations.
* Add checkbox in "VeraCrypt Format" wizard GUI to skip Rescue Disk verification during system encryption procedure.
* Allow files drag-n-drop when VeraCrypt is running as elevated process.
* Minor GUI and translations fixes.
# Linux:
* Fix mount issue on Fedora 23.
* Fix mount failure when compiling source code using gcc 5.x.
* Adhere to XDG Desktop Specification by using XDG_CONFIG_HOME to determine location of configuration files.
# Mac OSX:
* Solve compatibility issue with newer versions of OSXFuse.

- Fix dll hijacking issue affecting installer that allows code execution with elevation of privilege (CVE-2016-1281).
- Sign binaries using both SHA-1 and SHA-256 to follow new Microsoft recommendations.
- Solve issues under Comodo/Kaspersky when running an application from a VeraCrypt volume
- Bootloader: Protect password/PIM length by filling the fields to maximum length with '*' after ENTER
- Solve issue with system favorites not being able to be mounted to drive A:
- Solve lost focus issues for after displaying the waiting dialog
- Solve rare issue where some partitions where associated with wrong disk the "Select Device" dialog.
- Implement PIM caching, for both system encryption and normal volumes. Add options to activate it.
- Don't try mounting using cached passwords if password and/or keyfile are specified in the command line.
- Internal rewrite to make VeraCrypt native UNICODE application.
- Workaround to avoid false positive detection by some anti-virus software.
- Hide disconnected network drives in the list of available drives. Add option to make them available for mounting.
- Solve issue that caused in some cases configuration and history XML files to be updated even when not needed.
- Fix leak of path of selected keyfiles in RAM.
- Fix TB unit can't be deselected in VeraCryptExpander.
- Add Alt+i keyboard shortcut for "Use PIM" checkbox.
- Minor GUI and translations fixes.

* All OSs:
- Support UNICODE passwords: all characters are now accepted in passwords (except Windows system encryption)
- Cut mount/boot time by half thanks to a clever optimization of key derivation (found by Xavier de Carné de Carnavalet)
- Optimize Whirlpool code by using assembly (25% speed gain compared to previous code).
- Add support for creating exFAT volumes.
- Include new icons and graphics contributed by Andreas Becker (http://www.andreasbecker.de)
* Windows:
- Fix dll hijacking issue affecting installer that allows code execution with elevation of privilege (CVE-2016-1281). Reported by Stefan Kanthak (http://home.arcor.de/skanthak/)
- Sign binaries using both SHA-1 and SHA-256 to follow new Microsoft recommendations.
- Solve issues under Comodo/Kaspersky when running an application from a VeraCrypt volume (Reported and fixed by Robert Geisler)
- Bootloader: Protect password/PIM length by filling the fields to maximum length with '*' after ENTER
- Solve issue with system favorites not being able to be mounted to drive A:
- Solve lost focus issues for after displaying the waiting dialog
- Implement PIM caching, for both system encryption and normal volumes. Add options to activate it.
- Internal rewrite to make VeraCrypt native UNICODE application.
- Workaround to avoid false positive detection by some anti-virus software.
- Add GUI indicator for the amount of randomness gathered using mouse movement.
- Hide disconnected network drives in the list of available drives. Add option to make them available for mounting.
- Solve issue that caused in some cases configuration and history XML files to be updated even when not needed.
- Fix leak of path of selected keyfiles in RAM.
- Fix TB unit can't be deselected in VeraCryptExpander.
- Add Alt+i keyboard shortcut for "Use PIM" checkbox.
- Minor GUI and translations fixes.
* Linux/MacOSX:
- Fix issue of --stdin option not handling correctly passwords that contain a space character (reported and fixed by Codeplex user horsley1953).
- Fix issue creating volumes using command line with a filesystem other than FAT.
- Support K/M/G/T suffixes for --size switch to indicate unit to use for size value.

# All OSs:
* Support UNICODE passwords: all characters are now accepted in passwords (except Windows system encryption)
* Cut mount/boot time by half thanks to a clever optimization of key derivation
# Windows:
* Fix dll hijacking issue affecting installer that allows code execution with elevation of privilege.
* Sign binaries using both SHA-1 and SHA-256 to follow new Microsoft recommendations.
* Solve issues under Comodo/Kaspersky when running an application from a VeraCrypt volume
* Bootloader: Protect password/PIM length by filling the fields to maximum length with '*' after ENTER
* Solve issue with system favorites not being able to be mounted to drive A:
* Solve lost focus issues for after displaying the waiting dialog
* Implement PIM caching, for both system encryption and normal volumes. Add options to activate it.
* Internal rewrite to make VeraCrypt native UNICODE application.
* Workaround to avoid false positive detection by some anti-virus software.
* Hide disconnected network drives in the list of available drives. Add option to make them available for mounting.
* Solve issue that caused in some cases configuration and history XML files to be updated even when not needed.
* Fix leak of path of selected keyfiles in RAM.
* Fix TB unit can't be deselected in VeraCryptExpander.
* Add Alt+i keyboard shortcut for "Use PIM" checkbox.
* Minor GUI and translations fixes.

- Modify patch for CVE-2015-7358 vulnerability to solve side effects on Windows while still making it very hard to abuse drive letter handling.
- Fix failure to restore volume header from an external file in some configurations.
- Add option to disable “Evil Maid” attack detection for those encountering false positive cases (e.g. FLEXnet/Adobe issue).
- By default, don’t try to mount using empty password when default keyfile configured or keyfile specified in command line. Add option to restore the old behavior.
- If mounting using empty password is needed, explicitly specify so in the command line using: /p ""

- Fix two TrueCrypt vulnerabilities reported by James Forshaw (Google Project Zero)
* CVE-2015-7358 (critical): Local Elevation of Privilege on Windows by abusing drive letter handling.
* CVE-2015-7359: Local Elevation of Privilege on Windows caused by incorrect Impersonation Token Handling.
- Fix regression in mounting of favorite volumes at user logon.
- Fix display of some Unicode languages (e.g. Chinese) in formatting wizard.
- Set keyboard focus to PIM field when "Use PIM" is checked.
- Allow Application key to open context menu on drive letters list
- Support specifying volumes size in TB in the GUI (command line already supports this)

- All OSs:
* Mask and unmask PIM value in GUI and bootloader like the password.
- Windows:
* Solve Rescue Disk damaged error when using cascade ciphers and SHA256 for system encryption.
* Solve option "Cache password in drive memory" always disabled even if checked in preferences.
* Solve UI language change not taken into account for new install unless a preference is changed.
* Implement creating file containers using command line.
* Driver: disable support of IOCTL_STORAGE_QUERY_PROPERTY by default and add option to enable it.
* Driver: Support returning StorageDeviceProperty if IOCTL_STORAGE_QUERY_PROPERTY is supported.
* Support setting volume label in Explorer through mount option or favorite label value.
* Fix for Hot Keys assignment dialog issue where OEM-233 is always displayed and can't be changed.
* Always copy both 32-bit and 64-bit executable binaries during install and in Traveler Disk Setup.
- Traveler Disk will again use 32-bit exe by default while also offering 64-bit exe.
- On Windows 64-bit, 32-bit exe files are now available(e.g. if needed to use 32-bit PKCS#11 dll)
* Include Volume Expander in Traveler Disk Setup.
* Don't offer creating a restore point if it is disabled in Windows.
* Add possibility to verify a Rescue Disk ISO image file.
* Minors fixes in the installer, GUI and driver.
- Linux:
* Support supplying password using stdin in non interactive mode (contributed by LouisTakePILLz)
- Example: veracrypt -t ${IMAGE_PATH} ${MOUNT_PATH} --mount --non-interactive --stdin <<< "$PWD"

* Solve TOR crashing when run from a VeraCrypt volume.