Argon2id resume fails with ResumeInPlaceEncWaitThreadProc:408 on non-system volume

Open
  • Is something wrong?
#1,810 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Quiet
Tech stack
c
Domain
security

Research direction

Start at ResumeInPlaceEncWaitThreadProc:408 and compare the Argon2id header-decryption path with the related report in #1614. The interruption cause is still a placeholder, so first obtain that detail and a reproducible case; done means the interrupted non-system-volume encryption resumes successfully with the correct password.

Written by the indexing model from the issue text.

Description

bug

VeraCrypt version: 1.26.29
OS: Windows 11
Volume type: Non-system volume, internal HDD, in-place encryption
KDF used: Argon2id
PIM: Left empty (default)
Keyfile: None used
Hash/Cipher: default / not noted

Summary:
In-place encryption of an internal non-system hard drive was interrupted
at approximately 5% completion after [précise ici : ex. "a Windows
restart" / "a forced shutdown" / "clicking Defer"]. The volume cannot
be resumed or recovered afterward — VeraCrypt consistently fails to
decrypt the volume header with the correct password.

Error message:
"Operation failed due to one or more of the following:

  • Incorrect password
  • Incorrect Volume PIM number
  • Incorrect PRF (hash)
  • Not a valid volume
  • The volume uses an old algorithm that has been removed.
  • TrueCrypt volumes are no longer supported.
    Source: ResumeInPlaceEncWaitThreadProc:408"

Steps to reproduce:

  1. Start in-place encryption of a non-system internal HDD using
    Argon2id KDF with default (empty) PIM.
  2. Interrupt the process at low completion percentage (~5%) via
    [décris la cause exacte de l'interruption].
  3. Relaunch VeraCrypt — it correctly detects an interrupted process
    and prompts to resume Encrypt/Decrypt.
  4. Select "Encrypt", enter the password, select the correct device.
  5. Operation fails immediately with the error above.

Expected behavior:
Encryption resumes normally from the last processed sector.

Actual behavior:
Header decryption fails every time, even though:

  • The password has been verified correct via copy-paste (ruling out
    keyboard layout/typo issues)
  • No keyfile was used
  • PIM was left at default (empty)
  • The correct device/partition was selected (verified by size/ID)

Troubleshooting already attempted (all failed with same error):

  • Retyping the password directly
  • Copy-pasting the password from a text editor to rule out input errors
  • Closing all applications with potential disk access, including antivirus
  • Restarting the system before retrying
  • Restore Volume Header using the embedded backup header (Tools >
    Restore Volume Header, no external backup file) — same 408 error,
    suggesting both the primary and backup headers fail to decrypt
    identically with this password

Possible related issue:
This may be related to #1614 ("Possible Argon2id incorrect derived
key"), which describes header decryption failing with Argon2id KDF
despite using the correct password, in a controlled test case.

Data risk / urgency:
The volume was only ~5% encrypted when interrupted, meaning the vast
majority of data on the drive is still in its original unencrypted
state. However, without being able to resume or properly decrypt via
VeraCrypt, the drive currently cannot be safely used or accessed
through normal means.

Additional info:
Happy to provide further logs, a memory dump, or test with a
reproducible sample container if that would help diagnose whether
this is the same root cause as #1614.

Dominant language
C
Stars
11.7k
Forks
1.4k
Avg merge
1d 1h
Merged PRs (30d)
28

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from veracrypt/VeraCrypt

All issues in veracrypt/VeraCrypt

Similar issues

More C issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.