[flatstik]

Linux and macOS part of #1969 (see #1815 and #1831 for the same cost path).

When a volume is mounted with an empty password, every cached password is tried with the selected KDF, or with autodetection, which also tries Argon2. Above PIM 31, Argon2 uses 1 GiB and its passes grow with the PIM, so each cached password that does not belong to the volume took minutes.

The cache now keeps the KDF of the mounted volume with the password, and with autodetection each cached password is tried only with that KDF. A password used with several KDFs gets an entry for each. If the KDF is unknown, autodetection is used as before. An explicitly selected KDF is still used for all cached passwords.

The Windows driver cache (src/Common/Cache.c) has the same problem and is not changed here; I cannot test Windows or macOS.

Tested with three volumes (SHA-512, A and C share a password, B has another), mounted as favorites in one run with password caching, typing only the passwords of A and B:

• Tests/test_password_cache_kdf.py (new, PIM 100, run in the Linux workflow): with this change the run takes 1.8 s (ubuntu-24.04) and 2.1 s (ubuntu-26.04), against 0.4 to 0.5 s for one mount; on unchanged master it takes 173 s and the test fails. Runs on my fork: https://github.com/flatstik/VeraCrypt/actions/runs/40508100174 (this change), https://github.com/flatstik/VeraCrypt/actions/runs/40508103148 (master with only the test).
• Debian 13 x86_64 under QEMU, PIM 32: 19 s with this change, 1846 s without (one mount: 4 s). In both, C is mounted from the cache without a prompt.

[idrassi]

Thanks for investigating this and putting together a reproducible case. I have noted inline the issues I see.

Before revising the implementation, I would like us to settle what should happen when the quick attempts don't find a match. Preserving full autodetection means an unknown Argon2 volume may still need an expensive attempt. Simply adding a full retry at the end would bring back the original worst case. We need a deliberate choice about when to ask the user for input and when to continue searching.

[flatstik]

Thanks for the review. The test now dismounts only its own volumes and keeps its files if that fails (4ef4ad1); the implementation is unchanged until we settle the behaviour. A proposal:

1. The remembered KDF only orders the attempts. Every cached password is still tried with all PBKDF2 KDFs (so a password cached from a SHA-512 volume still opens a SHA-256 volume), with derivation failures handled as in autodetection rather than through an explicit Kdf.
2. First pass: all cached passwords with the PBKDF2 KDFs only, each with its remembered KDF first; entries learned with a PBKDF2 KDF before entries learned with Argon2.
3. Argon2 is attempted only for cached passwords whose entry was learned with Argon2 (at most one entry per password and KDF, without moving an Argon2 association ahead of a PBKDF2 one for the same password).
4. If nothing matches, the user is asked for the password instead of trying Argon2 with the remaining cached passwords. An Argon2 volume whose password is cached only from PBKDF2 volumes then needs the password once, after which its entry knows Argon2.

This bounds the cost of a cache miss to PBKDF2 derivations, plus Argon2 only for passwords that have been used with Argon2. Excluding Argon2 from an autodetection attempt needs a new mount option for the core service; I would add it like MountVolumeRequestV2, so that an older service rejects the request instead of ignoring the option.

Would this be acceptable, or would you rather keep full autodetection for some case in step 4 (for example the most recent entry)?

[flatstik]

Updated in 24a3019, which settles the question in the code rather than through a protocol change:

• With autodetection, each cached password is tried with the KDF it opened a volume with, then with the other PBKDF2 KDFs. Argon2 is tried only for passwords that opened an Argon2 volume, or a volume with an unknown KDF, through autodetection.
• If nothing matches, the user is asked for the password instead of trying Argon2 with every cached password. An Argon2 volume whose password is cached only from PBKDF2 volumes needs it once; afterwards its entry is known as Argon2.
• No new mount option is needed, contrary to what I wrote above: the attempts are made by the proxy, with an explicit PBKDF2 KDF or with autodetection.

The extra PBKDF2 attempts are made one at a time, so a cache miss costs more than before this PR's first version: in the test (PIM 100, three favorites) about 10 s instead of 2 s, against 173 s on master with Argon2. https://github.com/flatstik/VeraCrypt/actions/runs/40772767313