In Veracrypt which encryption algorithm and hash algorithm should I use

Question

While setting up encryption with Veracrypt, I noticed several options for encryption and hash algorithms. Which combinations provide the best balance between security and performance? Are there any recommendations based on specific use cases?

Answer 1

Choosing the right encryption and hash algorithms in Veracrypt depends on balancing security, performance, and compatibility, considering your specific use case.

Here's a guide to help you make an informed decision:

Encryption Algorithms

1. AES (Advanced Encryption Standard)

   Recommendation: AES is widely considered secure and is the default choice for many encryption tools. For most users, AES-256 (256-bit key) offers an excellent balance between security and performance. If you're looking for slightly better performance with still excellent security, AES-128 (128-bit key) is also a viable option, but it's generally recommended to opt for the higher key size if your hardware can handle it without noticeable slowdown.

2. Serpent and Twofish

   These are alternative encryption algorithms that can be used alone or in combination with AES in a cascaded encryption setup (e.g., AES-Twofish-Serpent). While they are considered secure, there's less ongoing scrutiny and analysis compared to AES, which might make them slightly less preferred by some security purists. However, combining them with AES can offer additional security at the cost of reduced performance.

3. Cascaded Encryption (e.g., AES-Twofish-Serpent)

   Use Case: Ultra-paranoid security where the slight chance of one algorithm being compromised is a significant concern. Keep in mind that using cascaded encryption will significantly impact performance.

Hash Algorithms

1. SHA-512

   • Recommendation for Most Users: Offers a high level of security. It's widely used and considered secure, making it a good default choice for most scenarios.

2. RIPEMD-160

   • Use Case: Specific regulatory or legacy system requirements might necessitate the use of RIPEMD-160. Otherwise, SHA-512 or Whirlpool are generally preferred for their higher security margins.

3. Whirlpool

   • Use Case: Similar to SHA-512, it's for those seeking high security. There's less widespread adoption and analysis compared to SHA-512, but it's still considered secure.

4. Streebog

   • Use Case: If you're in a jurisdiction or scenario where using a non-NIST (National Institute of Standards and Technology) approved hash is preferable or required, and you're looking for a hash function with a similar security level to SHA-512.