Skip to content

Windows: allow keeping key clearing on device insertion enabled until restart - #1983

Open
flatstik wants to merge 1 commit into
veracrypt:masterfrom
flatstik:fix-1982-clear-keys-latch
Open

Windows: allow keeping key clearing on device insertion enabled until restart#1983
flatstik wants to merge 1 commit into
veracrypt:masterfrom
flatstik:fix-1982-clear-keys-latch

Conversation

@flatstik

@flatstik flatstik commented Nov 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Fixes #1982.

"Clear encryption keys from memory if a new device is inserted" can be disabled at any time without a restart: by unchecking it, by changing its registry value, or by stopping the VeraCrypt system service, which is what clears the keys.

This PR offers, when the option is enabled, to also prevent it from being disabled until Windows restarts. The prompt defaults to No, so nothing changes for users who answer No.

  • The settings dialog requests this with a driver configuration flag, which only an administrator can write, and wakes the system service with a custom control; every local user can send custom controls to the service, so the control alone does nothing. The service locks the option in the driver with a new admin-only IOCTL; the driver keeps that state until Windows restarts. A second IOCTL reports the state.
  • While locked:
    • the service clears the keys on new device insertion, whatever the registry value says;
    • the service no longer rebuilds its list of known devices;
    • the service does not accept SERVICE_CONTROL_STOP;
    • the settings dialog shows the option checked and disabled.
  • Setup already replaces a service that cannot be stopped when Windows restarts. When stopping it fails, Setup now also sets a service configuration flag. The running executable then does not reinstall its own, older boot loader or SetupConfig; the next service start clears the flag.
  • The lock is requested after the other settings are saved. If the driver does not confirm it, an error is shown.
  • The lock does not protect against an administrator, who can still terminate the service process. The prompt and the documentation say so.

The Linux and macOS counterpart is in #1984.

Testing:

  • I do not have Windows, so this is not run-tested.
  • It compiles with MSVC 2022 and WDK 10.0.26100 on a GitHub Windows runner. That covers the driver (including Ntdriver.c), Mount, Format, ExpandVolume, Setup and SetupDLL; no compiler warnings came from the changed files.
  • An independent code review was done. Its findings are addressed: the superseded-service boot loader issue, the lock request no longer aborting the other settings, and the dialog when the service is not running while locked.

Since I cannot test on Windows (or macOS), please feel free to merge this, close it, or take it as a basis for your own implementation, as you see fit.

@flatstik flatstik mentioned this pull request Nov 2, 2026
Open
@amdigyira amdigyira mentioned this pull request Nov 2, 2026
Open
@flatstik
flatstik force-pushed the fix-1982-clear-keys-latch branch 2 times, most recently from 2632683 to cc92bb5 Compare November 3, 2026 17:04
@idrassi
idrassi requested a max review from Copilot November 7, 2026 05:32
Copilot AI reviewed Nov 7, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Insufficient service-control permissions allow local non-administrators to trigger key wiping or encrypted-system crashes on device insertion and disable boot-loader and SetupConfig maintenance.

1 open issue
What changed in this PR

This PR adds an optional until-restart lock to Windows device-insertion key clearing, addressing #1982 within VeraCrypt’s system-encryption protections.

Changes:

  • Adds driver lock/query controls and integrates the lock with system settings and service behavior.
  • Prevents a superseded service from restoring older boot-loader components before restart.
  • Adds lock prompts, failure messages, and documentation explaining the administrator limitation.
File Description
Translations/​Language.zh-tw.xml Adds English lock messages.
Translations/​Language.zh-hk.xml Adds English lock messages.
Translations/​Language.zh-cn.xml Adds English lock messages.
Translations/​Language.vi.xml Adds English lock messages.
Translations/​Language.uz.xml Adds English lock messages.
Translations/​Language.uk.xml Adds English lock messages.
Translations/​Language.tr.xml Adds English lock messages.
Translations/​Language.th.xml Adds English lock messages.
Translations/​Language.sv.xml Adds English lock messages.
Translations/​Language.sl.xml Adds English lock messages.
Translations/​Language.sk.xml Adds English lock messages.
Translations/​Language.ru.xml Adds English lock messages.
Translations/​Language.ro.xml Adds English lock messages.
Translations/​Language.pt-br.xml Adds English lock messages.
Translations/​Language.pl.xml Adds English lock messages.
Translations/​Language.nn.xml Adds English lock messages.
Translations/​Language.nl.xml Adds English lock messages.
Translations/​Language.nb.xml Adds English lock messages.
Translations/​Language.my.xml Adds English lock messages.
Translations/​Language.lv.xml Adds English lock messages.
Translations/​Language.ko.xml Adds English lock messages.
Translations/​Language.ka.xml Adds English lock messages.
Translations/​Language.ja.xml Adds English lock messages.
Translations/​Language.it.xml Adds English lock messages.
Translations/​Language.id.xml Adds English lock messages.
Translations/​Language.hu.xml Adds English lock messages.
Translations/​Language.he.xml Adds English lock messages.
Translations/​Language.fr.xml Adds English lock messages.
Translations/​Language.fi.xml Adds English lock messages.
Translations/​Language.fa.xml Adds English lock messages.
Translations/​Language.eu.xml Adds English lock messages.
Translations/​Language.et.xml Adds English lock messages.
Translations/​Language.es.xml Adds English lock messages.
Translations/​Language.el.xml Adds English lock messages.
Translations/​Language.de.xml Adds English lock messages.
Translations/​Language.da.xml Adds English lock messages.
Translations/​Language.cs.xml Adds English lock messages.
Translations/​Language.co.xml Adds English lock messages.
Translations/​Language.ca.xml Adds English lock messages.
Translations/​Language.bg.xml Adds English lock messages.
Translations/​Language.be.xml Adds English lock messages.
Translations/​Language.ar.xml Adds English lock messages.
src/​SetupDLL/​Setup.c Notifies an unstoppable service that it is superseded.
src/​Setup/​Setup.c Sends the superseded notification during installation.
src/​Mount/​Mount.c Integrates locking into the service and settings dialog.
src/​Driver/​Ntdriver.c Stores and reports the until-restart lock state.
src/​Common/​Language.xml Defines the English lock prompt and failure message.
src/​Common/​Dlgcode.h Declares service controls and the lock-query helper.
src/​Common/​Dlgcode.c Forwards new notifications and queries driver lock state.
src/​Common/​Apidrvr.h Defines the lock and query driver controls.
doc/​html/​en/​VeraCrypt RAM Encryption.html Documents lock activation and its administrator limitation.

Review effort: Max

Comment thread src/Mount/Mount.c Resolved
@flatstik
flatstik force-pushed the fix-1982-clear-keys-latch branch 2 times, most recently from 9b96f83 to 5854701 Compare November 8, 2026 16:57
@flatstik
Windows: allow keeping key clearing on device insertion enabled until…
5c68ffa 
… restart

"Clear encryption keys from memory if a new device is inserted" can be
disabled at any time without a restart: by unchecking it, by changing
its registry value, or by stopping the VeraCrypt system service, which
is what clears the keys. Someone at an unlocked machine can then
connect a device without the keys being cleared.

When the option is enabled, offer to also prevent it from being
disabled until Windows restarts. The dialog requests this with a driver
configuration flag, which only an administrator can write (every local
user can send custom controls to the service, so a control alone is not
enough), and the service then locks the option in the driver, which
keeps this state until Windows restarts. While locked:

- the service clears the keys on new device insertion whatever the
  registry value, and does not rebuild its list of known devices;
- the service does not accept SERVICE_CONTROL_STOP. Setup already
  replaces a service that cannot be stopped when Windows restarts; it
  now also sets a service configuration flag, so that the running
  executable does not reinstall its own, older boot loader until then;
- the settings dialog shows the option as checked and disabled.

The lock is requested after the other settings are saved; if it cannot
be confirmed through the driver, an error is shown.
This does not protect against an administrator, who can still
terminate the service process.

Fixes veracrypt#1982
@flatstik
flatstik force-pushed the fix-1982-clear-keys-latch branch from 5854701 to 5c68ffa Compare November 10, 2026 15:01
@flatstik flatstik mentioned this pull request Nov 11, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Option to prevent disabling "Clear encryption keys from memory if a new device is inserted" until next reboot

2 participants

@flatstik