Windows: define a new formula for Argon2 parameters derivation from PIM value

Bootloader doesn't support Argon2 yet. We don't want to add overhead to automatic detection for now.

src/Common/BootEncryption.cpp

@@ -1707,6 +1707,8 @@ namespace VeraCrypt
 					pkcs5_prf = WHIRLPOOL;
 				else if (_stricmp(request.BootPrfAlgorithmName, "Streebog") == 0)
 					pkcs5_prf = STREEBOG;
+				else if (_stricmp(request.BootPrfAlgorithmName, "Argon2") == 0)
+					pkcs5_prf = ARGON2;
                         #endif
 				else if (strlen(request.BootPrfAlgorithmName) == 0) // case of version < 1.0f
 					pkcs5_prf = BLAKE2S;
@@ -1739,6 +1741,10 @@ namespace VeraCrypt
 		if (!bIsGPT && pkcs5_prf != BLAKE2S && pkcs5_prf != SHA256)
 			throw ParameterIncorrect (SRC_POS);
 
+		// we don't support Argon2 for system encryption for now
+		if (pkcs5_prf == ARGON2)
+			throw ParameterIncorrect (SRC_POS);
+
 		int bootSectorId = 0;
 		int bootLoaderId = 0;
 

src/Common/Crypto.c

@@ -132,6 +132,7 @@ static Hash Hashes[] =
         { BLAKE2S,		L"BLAKE2s-256",				FALSE,	TRUE },
         { WHIRLPOOL,	L"Whirlpool",			FALSE,	FALSE },
 	{ STREEBOG,		L"Streebog",	FALSE,	FALSE },
+	{ ARGON2,		L"Argon2",	FALSE,	FALSE },
     #endif
         { 0, 0, 0 }
 };
@@ -821,6 +822,11 @@ BOOL HashForSystemEncryption (int hashId)
 
 }
 
+BOOL HashIsAvailable (int hashId)
+{
+   return (hashId != ARGON2) && (HashGet(hashId) != 0); // Argon2 is not a hash function
+}
+
 // Returns the largest key size needed by an EA for the specified mode of operation
 int EAGetLargestKeyForMode (int mode)
 {

src/Common/Crypto.h

@@ -55,6 +55,7 @@ enum
 	SHA256,
 	BLAKE2S,
 	STREEBOG,
+	ARGON2,
 	HASH_ENUM_END_ID
 };
 
@@ -226,6 +227,7 @@ typedef struct
 typedef struct keyInfo_t
 {
 	int noIterations;					/* Number of times to iterate (PKCS-5) */
+	int memoryCost;						/* Memory cost factor (PKCS-5) */
 	int keyLength;						/* Length of the key */
 	uint64 dummy;						/* Dummy field to ensure 16-byte alignment of this structure */
 	__int8 salt[PKCS5_SALT_SIZE];		/* PKCS-5 salt */
@@ -257,6 +259,7 @@ typedef struct CRYPTO_INFO_t
 #endif
 
 	int noIterations;	
+	int memoryCost;
 	int volumePim;
 
 	BOOL bProtectHiddenVolume;			// Indicates whether the volume contains a hidden volume to be protected against overwriting
@@ -375,6 +378,7 @@ Hash *HashGet (int id);
 void HashGetName2 (wchar_t *buf, size_t bufLen, int hashId);
 BOOL HashIsDeprecated (int hashId);
 BOOL HashForSystemEncryption (int hashId);
+BOOL HashIsAvailable (int hashId);
 int GetMaxPkcs5OutSize (void);
 #endif
 

src/Common/Dlgcode.c

@@ -367,6 +367,8 @@ typedef struct
 	unsigned __int64 encSpeed;
 	unsigned __int64 decSpeed;
 	unsigned __int64 meanBytesPerSec;
+	unsigned __int64 iterations;
+	unsigned __int64 memoryCost;
 } BENCHMARK_REC;
 
 BENCHMARK_REC benchmarkTable [BENCHMARK_MAX_ITEMS];
@@ -6014,6 +6016,11 @@ static void ResetBenchmarkList (HWND hwndDlg)
 		LvCol.cx = CompensateXDPI (80);
 		LvCol.fmt = LVCFMT_RIGHT;
 		SendMessageW (hList,LVM_INSERTCOLUMNW,2,(LPARAM)&LvCol);
+
+		LvCol.pszText = GetString ("MEMORY_COST");
+		LvCol.cx = CompensateXDPI (80);
+		LvCol.fmt = LVCFMT_RIGHT;
+		SendMessageW (hList,LVM_INSERTCOLUMNW,3,(LPARAM)&LvCol);
 		break;
 	}
 }
@@ -6111,10 +6118,14 @@ static void DisplayBenchmarkResults (HWND hwndDlg)
 			LvItem.iSubItem = 1;
 			LvItem.pszText = item1;
 			SendMessageW (hList, LVM_SETITEMW, 0, (LPARAM)&LvItem); 
-			swprintf_s (item1, sizeof(item1) / sizeof(item1[0]), L"%d", (int) benchmarkTable[i].decSpeed);
+			swprintf_s (item1, sizeof(item1) / sizeof(item1[0]), L"%d", (int) benchmarkTable[i].iterations);
 			LvItem.iSubItem = 2;
 			LvItem.pszText = item1;
 			SendMessageW (hList, LVM_SETITEMW, 0, (LPARAM)&LvItem); 
+			swprintf_s (item1, sizeof(item1) / sizeof(item1[0]), L"%d", (int) benchmarkTable[i].memoryCost);
+			LvItem.iSubItem = 3;
+			LvItem.pszText = item1;
+			SendMessageW (hList, LVM_SETITEMW, 0, (LPARAM)&LvItem); 
 			break;
 		}
 	}
@@ -6203,6 +6214,9 @@ static BOOL PerformBenchmark(HWND hBenchDlg, HWND hwndDlg)
 
 			for (hid = FIRST_PRF_ID; hid <= LAST_PRF_ID; hid++) 
 			{
+				// Skip Argon2 since it is not a hash function
+				if (hid == ARGON2)
+					continue;
 				if (QueryPerformanceCounter (&performanceCountStart) == 0)
 					goto counter_error;
 
@@ -6268,43 +6282,55 @@ static BOOL PerformBenchmark(HWND hBenchDlg, HWND hwndDlg)
 		int thid, i;
 		char dk[MASTER_KEYDATA_SIZE];
 		char *tmp_salt = {"\x00\x11\x22\x33\x44\x55\x66\x77\x88\x99\xAA\xBB\xCC\xDD\xEE\xFF\x01\x23\x45\x67\x89\xAB\xCD\xEF\x00\x11\x22\x33\x44\x55\x66\x77\x88\x99\xAA\xBB\xCC\xDD\xEE\xFF\x01\x23\x45\x67\x89\xAB\xCD\xEF\x00\x11\x22\x33\x44\x55\x66\x77\x88\x99\xAA\xBB\xCC\xDD\xEE\xFF"};
+		int memoryCost = 0;
+		int iterations = 0;
 
 		for (thid = FIRST_PRF_ID; thid <= LAST_PRF_ID; thid++) 
 		{
 			if (benchmarkPreBoot && !benchmarkGPT && !HashForSystemEncryption (thid))
 				continue;
+			
+			// we don't support Argon2 for system encryption
+			if (benchmarkPreBoot && thid == ARGON2)
+				continue;
 
 			if (QueryPerformanceCounter (&performanceCountStart) == 0)
 				goto counter_error;
 
 			for (i = 1; i <= 2; i++) 
 			{
+				iterations = get_pkcs5_iteration_count(thid, benchmarkPim, benchmarkPreBoot, &memoryCost);
 				switch (thid)
 				{
 
 				case SHA512:
 					/* PKCS-5 test with HMAC-SHA-512 used as the PRF */
-					derive_key_sha512 ("passphrase-1234567890", 21, tmp_salt, 64, get_pkcs5_iteration_count(thid, benchmarkPim, benchmarkPreBoot), dk, MASTER_KEYDATA_SIZE);
+					derive_key_sha512 ("passphrase-1234567890", 21, tmp_salt, 64, iterations, dk, MASTER_KEYDATA_SIZE);
 					break;
 
 				case SHA256:
 					/* PKCS-5 test with HMAC-SHA-256 used as the PRF */
-					derive_key_sha256 ("passphrase-1234567890", 21, tmp_salt, 64, get_pkcs5_iteration_count(thid, benchmarkPim, benchmarkPreBoot), dk, MASTER_KEYDATA_SIZE);
+					derive_key_sha256 ("passphrase-1234567890", 21, tmp_salt, 64, iterations, dk, MASTER_KEYDATA_SIZE);
 					break;
                           #ifndef WOLFCRYPT_BACKEND
 				case BLAKE2S:
 					/* PKCS-5 test with HMAC-BLAKE2s used as the PRF */
-					derive_key_blake2s ("passphrase-1234567890", 21, tmp_salt, 64, get_pkcs5_iteration_count(thid, benchmarkPim, benchmarkPreBoot), dk, MASTER_KEYDATA_SIZE);
+					derive_key_blake2s ("passphrase-1234567890", 21, tmp_salt, 64, iterations, dk, MASTER_KEYDATA_SIZE);
 					break;
 
 				case WHIRLPOOL:
 					/* PKCS-5 test with HMAC-Whirlpool used as the PRF */
-					derive_key_whirlpool ("passphrase-1234567890", 21, tmp_salt, 64, get_pkcs5_iteration_count(thid, benchmarkPim, benchmarkPreBoot), dk, MASTER_KEYDATA_SIZE);
+					derive_key_whirlpool ("passphrase-1234567890", 21, tmp_salt, 64, iterations, dk, MASTER_KEYDATA_SIZE);
 					break;
 
 				case STREEBOG:
 					/* PKCS-5 test with HMAC-STREEBOG used as the PRF */
-					derive_key_streebog("passphrase-1234567890", 21, tmp_salt, 64, get_pkcs5_iteration_count(thid, benchmarkPim, benchmarkPreBoot), dk, MASTER_KEYDATA_SIZE);
+					derive_key_streebog("passphrase-1234567890", 21, tmp_salt, 64, iterations, dk, MASTER_KEYDATA_SIZE);
+					break;
+				
+				case ARGON2:
+					/* test with ARGON2 used as the PRF */
+					derive_key_argon2 ("passphrase-1234567890", 21, tmp_salt, 64, iterations, memoryCost, dk, MASTER_KEYDATA_SIZE);
 					break;
 				}
 	                   #endif	
@@ -6315,7 +6341,8 @@ static BOOL PerformBenchmark(HWND hBenchDlg, HWND hwndDlg)
 
 			benchmarkTable[benchmarkTotalItems].encSpeed = performanceCountEnd.QuadPart - performanceCountStart.QuadPart;
 			benchmarkTable[benchmarkTotalItems].id = thid;
-			benchmarkTable[benchmarkTotalItems].decSpeed = get_pkcs5_iteration_count(thid, benchmarkPim, benchmarkPreBoot);
+			benchmarkTable[benchmarkTotalItems].iterations = iterations;
+			benchmarkTable[benchmarkTotalItems].memoryCost = memoryCost;
 			benchmarkTable[benchmarkTotalItems].meanBytesPerSec = (unsigned __int64) (1000 * ((float) benchmarkTable[benchmarkTotalItems].encSpeed / benchmarkPerformanceFrequency.QuadPart / 2));
 			if (benchmarkPreBoot)
 			{
@@ -6777,7 +6804,7 @@ static BOOL CALLBACK RandomPoolEnrichementDlgProc (HWND hwndDlg, UINT msg, WPARA
 			SendMessage (hComboBox, CB_RESETCONTENT, 0, 0);
 			for (hid = FIRST_PRF_ID; hid <= LAST_PRF_ID; hid++)
 			{
-				if (!HashIsDeprecated (hid))
+				if (!HashIsDeprecated (hid) && HashIsAvailable (hid))
 					AddComboPair (hComboBox, HashGetName(hid), hid);
 			}
 			SelectAlgo (hComboBox, &hash_algo);
@@ -6972,7 +6999,7 @@ BOOL CALLBACK KeyfileGeneratorDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LP
 			SendMessage (hComboBox, CB_RESETCONTENT, 0, 0);
 			for (hid = FIRST_PRF_ID; hid <= LAST_PRF_ID; hid++)
 			{
-				if (!HashIsDeprecated (hid))
+				if (!HashIsDeprecated (hid) && HashIsAvailable (hid))
 					AddComboPair (hComboBox, HashGetName(hid), hid);
 			}
 			SelectAlgo (hComboBox, &hash_algo);

src/Common/EncryptionThreadPool.c

@@ -100,6 +100,7 @@ typedef struct EncryptionThreadPoolWorkItemStruct
 			LONG *CompletionFlag;
 			char *DerivedKey;
 			int IterationCount;
+			int Memorycost;
 			TC_EVENT *NoOutstandingWorkItemEvent;
 			LONG *OutstandingWorkItemCount;
 			char *Password;
@@ -273,6 +274,11 @@ static TC_THREAD_PROC EncryptionThreadProc (void *threadArg)
 					workItem->KeyDerivation.IterationCount, workItem->KeyDerivation.DerivedKey, GetMaxPkcs5OutSize());
 				break;
 
+			case ARGON2:
+				derive_key_argon2(workItem->KeyDerivation.Password, workItem->KeyDerivation.PasswordLength, workItem->KeyDerivation.Salt, PKCS5_SALT_SIZE,
+					workItem->KeyDerivation.IterationCount, workItem->KeyDerivation.Memorycost, workItem->KeyDerivation.DerivedKey, GetMaxPkcs5OutSize());
+				break;
+
 			default:
 				TC_THROW_FATAL_EXCEPTION;
 			}
@@ -533,7 +539,7 @@ void EncryptionThreadPoolStop ()
 }
 
 
-void EncryptionThreadPoolBeginKeyDerivation (TC_EVENT *completionEvent, TC_EVENT *noOutstandingWorkItemEvent, LONG *completionFlag, LONG *outstandingWorkItemCount, int pkcs5Prf, char *password, int passwordLength, char *salt, int iterationCount, char *derivedKey)
+void EncryptionThreadPoolBeginKeyDerivation (TC_EVENT *completionEvent, TC_EVENT *noOutstandingWorkItemEvent, LONG *completionFlag, LONG *outstandingWorkItemCount, int pkcs5Prf, char *password, int passwordLength, char *salt, int iterationCount, int memoryCost, char *derivedKey)
 {
 	EncryptionThreadPoolWorkItem *workItem;
 
@@ -556,6 +562,7 @@ void EncryptionThreadPoolBeginKeyDerivation (TC_EVENT *completionEvent, TC_EVENT
 	workItem->KeyDerivation.CompletionFlag = completionFlag;
 	workItem->KeyDerivation.DerivedKey = derivedKey;
 	workItem->KeyDerivation.IterationCount = iterationCount;
+	workItem->KeyDerivation.Memorycost = memoryCost;
 	workItem->KeyDerivation.NoOutstandingWorkItemEvent = noOutstandingWorkItemEvent;
 	workItem->KeyDerivation.OutstandingWorkItemCount = outstandingWorkItemCount;
 	workItem->KeyDerivation.Password = password;

src/Common/EncryptionThreadPool.h

@@ -32,7 +32,7 @@ typedef enum
 size_t GetCpuCount (WORD* pGroupCount);
 #endif
 
-void EncryptionThreadPoolBeginKeyDerivation (TC_EVENT *completionEvent, TC_EVENT *noOutstandingWorkItemEvent, LONG *completionFlag, LONG *outstandingWorkItemCount, int pkcs5Prf, char *password, int passwordLength, char *salt, int iterationCount, char *derivedKey);
+void EncryptionThreadPoolBeginKeyDerivation (TC_EVENT *completionEvent, TC_EVENT *noOutstandingWorkItemEvent, LONG *completionFlag, LONG *outstandingWorkItemCount, int pkcs5Prf, char *password, int passwordLength, char *salt, int iterationCount, int memoryCost, char *derivedKey);
 void EncryptionThreadPoolBeginReadVolumeHeaderFinalization (TC_EVENT *keyDerivationCompletedEvent, TC_EVENT *noOutstandingWorkItemEvent, LONG* outstandingWorkItemCount, void* keyInfoBuffer, int keyInfoBufferSize, void* keyDerivationWorkItems, int keyDerivationWorkItemsSize);
 void EncryptionThreadPoolDoWork (EncryptionThreadPoolWorkType type, uint8 *data, const UINT64_STRUCT *startUnitNo, uint32 unitCount, PCRYPTO_INFO cryptoInfo);
 BOOL EncryptionThreadPoolStart (size_t encryptionFreeCpuCount);

src/Common/Language.xml

@@ -1641,6 +1641,7 @@
     <entry lang="en" key="ERR_XTS_MASTERKEY_VULNERABLE">WARNING: The volume's master key is vulnerable to an attack that compromises data security.\n\nPlease create a new volume and transfer the data to it.</entry>
     <entry lang="en" key="ERR_SYSENC_XTS_MASTERKEY_VULNERABLE">WARNING: The encrypted system's master key is vulnerable to an attack that compromises data security.\nPlease decrypt the system partition/drive and then re-encrypt it.</entry>
     <entry lang="en" key="ERR_XTS_MASTERKEY_VULNERABLE_SHORT">WARNING: The volume's master key has a security vulnerability.</entry>
+    <entry lang="en" key="MEMORY_COST">Memory Cost</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">

src/Common/Pkcs5.c

@@ -1271,6 +1271,9 @@ wchar_t *get_pkcs5_prf_name (int pkcs5_prf_id)
 	case STREEBOG:
 		return L"HMAC-STREEBOG";
 
+	case ARGON2:
+		return L"Argon2";
+
 	default:		
 		return L"(Unknown)";
 	}
@@ -1278,14 +1281,17 @@ wchar_t *get_pkcs5_prf_name (int pkcs5_prf_id)
 
 
 
-int get_pkcs5_iteration_count (int pkcs5_prf_id, int pim, BOOL bBoot)
+int get_pkcs5_iteration_count (int pkcs5_prf_id, int pim, BOOL bBoot, int* pMemoryCost)
 {
 	if (	(pim < 0)
 		)
 	{
+		*pMemoryCost = 0;
 		return 0;
 	}
 
+	*pMemoryCost = 0;
+
 	switch (pkcs5_prf_id)
 	{
 
@@ -1319,6 +1325,13 @@ int get_pkcs5_iteration_count (int pkcs5_prf_id, int pim, BOOL bBoot)
 			return bBoot? pim * 2048 : 15000 + pim * 1000;
 		}
 
+	case ARGON2:
+		{
+			int iterations;
+			get_argon2_params (pim, &iterations, pMemoryCost);
+			return iterations;
+		}
+
 	default:		
 		TC_THROW_FATAL_EXCEPTION;	// Unknown/wrong ID
 	}
@@ -1336,9 +1349,101 @@ int is_pkcs5_prf_supported (int pkcs5_prf_id, PRF_BOOT_TYPE bootType)
 		|| (bootType != PRF_BOOT_MBR && (pkcs5_prf_id < FIRST_PRF_ID || pkcs5_prf_id > LAST_PRF_ID))
 		)
       return 0;
+   // we don't support Argon2 in pre-boot authentication
+   if ((bootType == PRF_BOOT_MBR || bootType == PRF_BOOT_GPT) && pkcs5_prf_id == ARGON2)
+	  return 0;	
 
    return 1;
 
 }
 
+void derive_key_argon2(char *pwd, int pwd_len, char *salt, int salt_len, uint32 iterations, uint32 memcost, char *dk, int dklen)
+{
+	//TODO: Implement Argon2 derivation
+	// In case of failure, just fill the derived key dk with zeroes
+	memset(dk, 0, dklen);
+}
+
+/**
+ * get_argon2_params
+ * 
+ * This function calculates the memory cost (in KiB) and time cost (iterations) for 
+ * the Argon2id key derivation function based on the Personal Iteration Multiplier (PIM) value.
+ * 
+ * Parameters:
+ *   - pim: The Personal Iteration Multiplier (PIM), which controls the memory and time costs.
+ *          If pim < 0, it is clamped to 0.
+ *          If pim == 0, the default value of 12 is used.
+ *   - pIterations: Pointer to an integer where the calculated time cost (iterations) will be stored.
+ *   - pMemcost: Pointer to an integer where the calculated memory cost (in KiB) will be stored.
+ * 
+ * Formulas:
+ *   - Memory Cost (m_cost) in MiB:
+ *     m_cost(pim) = min(64 MiB + (pim - 1) * 32 MiB, 1024 MiB)
+ *     This formula increases the memory cost by 32 MiB for each increment of PIM, starting from 64 MiB.
+ *     The memory cost is capped at 1024 MiB when PIM reaches 31 or higher.
+ *     The result is converted to KiB before being stored in *pMemcost:
+ *     *pMemcost = m_cost(pim) * 1024
+ * 
+ *   - Time Cost (t_cost) in iterations:
+ *     If PIM <= 31:
+ *        t_cost(pim) = 3 + floor((pim - 1) / 3)
+ *     If PIM > 31:
+ *        t_cost(pim) = 13 + (pim - 31)
+ *     This formula increases the time cost by 1 iteration for every 3 increments of PIM when PIM <= 31.
+ *     For PIM > 31, the time cost increases by 1 iteration for each increment in PIM.
+ *     The calculated time cost is stored in *pIterations.
+ * 
+ * Example:
+ *   - For PIM = 12:
+ *     Memory Cost = 64 + (12 - 1) * 32 = 416 MiB (425,984 KiB)
+ *     Time Cost = 3 + floor((12 - 1) / 3) = 6 iterations
+ * 
+ *   - For PIM = 31:
+ *     Memory Cost = 64 + (31 - 1) * 32 = 1024 MiB (capped)
+ *     Time Cost = 3 + floor((31 - 1) / 3) = 13 iterations
+ * 
+ *   - For PIM = 32:
+ *     Memory Cost = 1024 MiB (capped)
+ *     Time Cost = 13 + (32 - 31) = 14 iterations
+ * 
+ */
+void get_argon2_params(int pim, int* pIterations, int* pMemcost)
+{
+    // Ensure PIM is at least 0
+    if (pim < 0)
+    {
+        pim = 0;
+    }
+
+	// Default PIM value is 12
+	// which leads to 416 MiB memory cost and 6 iterations
+	if (pim == 0)
+	{
+		pim = 12;
+	}
+
+    // Compute the memory cost (m_cost) in MiB
+    int m_cost_mib = 64 + (pim - 1) * 32;
+
+    // Cap the memory cost at 1024 MiB
+    if (m_cost_mib > 1024)
+    {
+        m_cost_mib = 1024;
+    }
+
+    // Convert memory cost to KiB for Argon2
+    *pMemcost = m_cost_mib * 1024; // m_cost in KiB
+
+    // Compute the time cost (t_cost)
+    if (pim <= 31)
+    {
+        *pIterations = 3 + ((pim - 1) / 3);
+    }
+    else
+    {
+        *pIterations = 13 + (pim - 31);
+    }
+}
+
 #endif //!TC_WINDOWS_BOOT

src/Common/Pkcs5.h

@@ -40,9 +40,13 @@ void derive_key_whirlpool (char *pwd, int pwd_len, char *salt, int salt_len, uin
 void hmac_streebog (char *k, int32 lk, char *d, int32 ld);
 void derive_key_streebog (char *pwd, int pwd_len, char *salt, int salt_len, uint32 iterations, char *dk, int dklen);
 
-int get_pkcs5_iteration_count (int pkcs5_prf_id, int pim, BOOL bBoot);
+int get_pkcs5_iteration_count (int pkcs5_prf_id, int pim, BOOL bBoot, int* pMemoryCost);
 wchar_t *get_pkcs5_prf_name (int pkcs5_prf_id);
 
+void derive_key_argon2(char *pwd, int pwd_len, char *salt, int salt_len, uint32 iterations, uint32 memcost, char *dk, int dklen);
+void get_argon2_params(int pim, int* pIterations, int* pMemcost);
+
+
 /* check if given PRF supported.*/
 typedef enum
 {

src/Common/Random.c

@@ -282,7 +282,8 @@ BOOL Randmix ()
 			break;
 
         #ifndef WOLFCRYPT_BACKEND	
-               case BLAKE2S:
+		case ARGON2: // in case of Argon2, we use Blake2s
+        case BLAKE2S:
 			digestSize = BLAKE2S_DIGESTSIZE;
 			break;
 	
@@ -319,7 +320,8 @@ BOOL Randmix ()
 				break;
 
                 #ifndef WOLFCRYPT_BACKEND
-                      case BLAKE2S:
+			case ARGON2: // in case of Argon2, we use Blake2s
+            case BLAKE2S:
 				blake2s_init(&bctx);
 				blake2s_update(&bctx, pRandPool, RNG_POOL_SIZE);
 				blake2s_final(&bctx, hashOutputBuffer);
@@ -362,7 +364,8 @@ BOOL Randmix ()
 			break;
 
         #ifndef WOLFCRYPT_BACKEND
-               case BLAKE2S:
+		case ARGON2: // in case of Argon2, we use Blake2s
+        case BLAKE2S:
 			burn (&bctx, sizeof(bctx));
 			break;
 

src/Common/Volumes.c

@@ -192,6 +192,8 @@ int ReadVolumeHeader (BOOL bBoot, char *encryptedHeader, Password *password, int
 	size_t encryptionThreadCount = GetEncryptionThreadCount();
 	LONG *outstandingWorkItemCount = NULL;
 	int i;
+	int iterationsCount = 0;
+	int memoryCost = 0;
 #endif
 	size_t queuedWorkItems = 0;
 
@@ -306,6 +308,14 @@ int ReadVolumeHeader (BOOL bBoot, char *encryptedHeader, Password *password, int
 		// if a PRF is specified, we skip all other PRFs
 		if (selected_pkcs5_prf != 0 && enqPkcs5Prf != selected_pkcs5_prf)
 			continue;
+		
+		// we don't support Argon2 in pre-boot authentication
+		if (bBoot && (enqPkcs5Prf == ARGON2))
+			continue;
+
+		// For now, we don't included Argon2 in automatic detection
+		if (selected_pkcs5_prf == 0 && enqPkcs5Prf == ARGON2)
+			continue;
 
 #if !defined(_UEFI)
 		if ((selected_pkcs5_prf == 0) && (encryptionThreadCount > 1))
@@ -322,9 +332,10 @@ int ReadVolumeHeader (BOOL bBoot, char *encryptedHeader, Password *password, int
 						item->KeyReady = FALSE;
 						item->Pkcs5Prf = enqPkcs5Prf;
 
+						iterationsCount = get_pkcs5_iteration_count (enqPkcs5Prf, pim, bBoot, &memoryCost);
 						EncryptionThreadPoolBeginKeyDerivation (keyDerivationCompletedEvent, noOutstandingWorkItemEvent,
 							&item->KeyReady, outstandingWorkItemCount, enqPkcs5Prf, keyInfo->userKey,
-							keyInfo->keyLength, keyInfo->salt, get_pkcs5_iteration_count (enqPkcs5Prf, pim, bBoot), item->DerivedKey);
+							keyInfo->keyLength, keyInfo->salt, iterationsCount, memoryCost, item->DerivedKey);
 
 						++queuedWorkItems;
 						break;
@@ -346,7 +357,9 @@ int ReadVolumeHeader (BOOL bBoot, char *encryptedHeader, Password *password, int
 					if (!item->Free && InterlockedExchangeAdd (&item->KeyReady, 0) == TRUE)
 					{
 						pkcs5_prf = item->Pkcs5Prf;
-						keyInfo->noIterations = get_pkcs5_iteration_count (pkcs5_prf, pim, bBoot);
+						iterationsCount = get_pkcs5_iteration_count (pkcs5_prf, pim, bBoot, &memoryCost);
+						keyInfo->noIterations = iterationsCount;
+						keyInfo->memoryCost = memoryCost;
 						memcpy (dk, item->DerivedKey, sizeof (dk));
 
 						item->Free = TRUE;
@@ -365,7 +378,9 @@ KeyReady:	;
 #endif // !defined(_UEFI)
 		{
 			pkcs5_prf = enqPkcs5Prf;
-			keyInfo->noIterations = get_pkcs5_iteration_count (enqPkcs5Prf, pim, bBoot);
+			iterationsCount = get_pkcs5_iteration_count (enqPkcs5Prf, pim, bBoot, &memoryCost);
+			keyInfo->noIterations = iterationsCount;
+			keyInfo->memoryCost = memoryCost;
 
 			switch (pkcs5_prf)
 			{
@@ -380,21 +395,25 @@ KeyReady:	;
 				break;
 
                 #ifndef WOLFCRYPT_BACKEND
-                        case BLAKE2S:
+            case BLAKE2S:
 				derive_key_blake2s (keyInfo->userKey, keyInfo->keyLength, keyInfo->salt,
 					PKCS5_SALT_SIZE, keyInfo->noIterations, dk, GetMaxPkcs5OutSize());
 				break;
 
-	                case WHIRLPOOL:
+	        case WHIRLPOOL:
 				derive_key_whirlpool (keyInfo->userKey, keyInfo->keyLength, keyInfo->salt,
 					PKCS5_SALT_SIZE, keyInfo->noIterations, dk, GetMaxPkcs5OutSize());
 				break;
 
-
+            case STREEBOG:
-                        case STREEBOG:
 				derive_key_streebog(keyInfo->userKey, keyInfo->keyLength, keyInfo->salt,
 					PKCS5_SALT_SIZE, keyInfo->noIterations, dk, GetMaxPkcs5OutSize());
 				break;
+
+            case ARGON2:
+				derive_key_argon2(keyInfo->userKey, keyInfo->keyLength, keyInfo->salt,
+					PKCS5_SALT_SIZE, keyInfo->noIterations, keyInfo->memoryCost, dk, GetMaxPkcs5OutSize());
+				break;
                 #endif	
                         default:
 				// Unknown/wrong ID
@@ -540,6 +559,7 @@ KeyReady:	;
 					{
 						cryptoInfo->pkcs5 = pkcs5_prf;
 						cryptoInfo->noIterations = keyInfo->noIterations;
+						cryptoInfo->memoryCost = keyInfo->memoryCost;
 						cryptoInfo->volumePim = pim;
 						goto ret;
 					}
@@ -581,6 +601,7 @@ KeyReady:	;
 				// PKCS #5
 				cryptoInfo->pkcs5 = pkcs5_prf;
 				cryptoInfo->noIterations = keyInfo->noIterations;
+				cryptoInfo->memoryCost = keyInfo->memoryCost;
 				cryptoInfo->volumePim = pim;
 
 				// Init the cipher with the decrypted master key
@@ -910,6 +931,13 @@ int CreateVolumeHeaderInMemory (HWND hwndDlg, BOOL bBoot, char *header, int ea,
 	if (pim < 0)
 		pim = 0;
 
+	// we don't support Argon2 in pre-boot authentication
+	if (bBoot && (pkcs5_prf == ARGON2))
+	{
+		crypto_close (cryptoInfo);
+		return ERR_PARAMETER_INCORRECT;
+	}
+
 	memset (header, 0, TC_VOLUME_HEADER_EFFECTIVE_SIZE);
 #if !defined(_UEFI)
 	VirtualLock (&keyInfo, sizeof (keyInfo));
@@ -962,12 +990,13 @@ int CreateVolumeHeaderInMemory (HWND hwndDlg, BOOL bBoot, char *header, int ea,
 	{
 		memcpy (keyInfo.userKey, password->Text, nUserKeyLen);
 		keyInfo.keyLength = nUserKeyLen;
-		keyInfo.noIterations = get_pkcs5_iteration_count (pkcs5_prf, pim, bBoot);
+		keyInfo.noIterations = get_pkcs5_iteration_count (pkcs5_prf, pim, bBoot, &keyInfo.memoryCost);
 	}
 	else
 	{
 		keyInfo.keyLength = 0;
 		keyInfo.noIterations = 0;
+		keyInfo.memoryCost = 0;
 	}
 
 	// User selected encryption algorithm
@@ -976,6 +1005,7 @@ int CreateVolumeHeaderInMemory (HWND hwndDlg, BOOL bBoot, char *header, int ea,
 	// User selected PRF
 	cryptoInfo->pkcs5 = pkcs5_prf;
 	cryptoInfo->noIterations = keyInfo.noIterations;
+	cryptoInfo->memoryCost = keyInfo.memoryCost;
 	cryptoInfo->volumePim = pim;
 
 	// Mode of operation
@@ -1023,6 +1053,11 @@ int CreateVolumeHeaderInMemory (HWND hwndDlg, BOOL bBoot, char *header, int ea,
 			derive_key_streebog(keyInfo.userKey, keyInfo.keyLength, keyInfo.salt,
 				PKCS5_SALT_SIZE, keyInfo.noIterations, dk, GetMaxPkcs5OutSize());
 			break;
+
+		case ARGON2:
+			derive_key_argon2(keyInfo.userKey, keyInfo.keyLength, keyInfo.salt,
+				PKCS5_SALT_SIZE, keyInfo.noIterations, keyInfo.memoryCost, dk, GetMaxPkcs5OutSize());
+			break;
         #endif
 		default:
 			// Unknown/wrong ID

src/Format/Tcformat.c

@@ -4195,7 +4195,7 @@ BOOL CALLBACK PageDialogProc (HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lPa
 
 					for (hid = FIRST_PRF_ID; hid <= LAST_PRF_ID; hid++)
 					{
-						if ((!HashIsDeprecated (hid)) && (bSystemIsGPT || HashForSystemEncryption (hid)))
+						if ((!HashIsDeprecated (hid)) && (bSystemIsGPT || HashForSystemEncryption (hid)) && (hid != ARGON2)) // We don't support Argon2 for system encryption
 							AddComboPair (GetDlgItem (hwndDlg, IDC_COMBO_BOX_HASH_ALGO), HashGetName(hid), hid);
 					}
 				}
@@ -5988,7 +5988,7 @@ BOOL CALLBACK PageDialogProc (HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lPa
 				{
 					HWND hHashAlgoItem = GetDlgItem (hwndDlg, IDC_COMBO_BOX_HASH_ALGO);
 					int selectedAlgo = (int) SendMessage (hHashAlgoItem, CB_GETITEMDATA, SendMessage (hHashAlgoItem, CB_GETCURSEL, 0, 0), 0);
-					if (!bSystemIsGPT && !HashForSystemEncryption(selectedAlgo))
+					if ((!bSystemIsGPT && !HashForSystemEncryption(selectedAlgo)) || (selectedAlgo == ARGON2))
 					{
 						hash_algo = DEFAULT_HASH_ALGORITHM_BOOT;
 						RandSetHashFunction (DEFAULT_HASH_ALGORITHM_BOOT);

src/Mount/Mount.c

@@ -2749,7 +2749,7 @@ BOOL CALLBACK PasswordChangeDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPAR
 					int new_hash_algo_id = (int) SendMessage (GetDlgItem (hwndDlg, IDC_PKCS5_PRF_ID), CB_GETITEMDATA, 
 						SendMessage (GetDlgItem (hwndDlg, IDC_PKCS5_PRF_ID), CB_GETCURSEL, 0, 0), 0);
 
-					if (new_hash_algo_id != 0 && !bSystemIsGPT && !HashForSystemEncryption(new_hash_algo_id))
+					if (new_hash_algo_id != 0 && (!bSystemIsGPT && !HashForSystemEncryption(new_hash_algo_id)) || (new_hash_algo_id == ARGON2))
 					{
 						int new_hash_algo_id = DEFAULT_HASH_ALGORITHM_BOOT;
 						Info ("ALGO_NOT_SUPPORTED_FOR_SYS_ENCRYPTION", hwndDlg);
@@ -3094,7 +3094,7 @@ BOOL CALLBACK PasswordDlgProc (HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lPa
 
 			for (i = FIRST_PRF_ID; i <= LAST_PRF_ID; i++)
 			{
-				if (bSystemIsGPT || HashForSystemEncryption(i))
+				if ((bSystemIsGPT || HashForSystemEncryption(i)) && (i != ARGON2))
 				{
 					nIndex = (int) SendMessage (hComboBox, CB_ADDSTRING, 0, (LPARAM) get_pkcs5_prf_name(i));
 					SendMessage (hComboBox, CB_SETITEMDATA, nIndex, (LPARAM) i);