PIM stands for "Personal Iterations Multiplier". It is a parameter that was introduced in VeraCrypt 1.12 and whose value controls the number of iterations used by the header key derivation function. This value can be specified through the password dialog or in the command line.
If no PIM value is specified, VeraCrypt will use the default number of iterations used in versions prior to 1.12 (see Header Key Derivation).
When a PIM value is specified, the number of iterations is calculated as follows:
- For system encryption that doesn't use SHA-512 or Whirlpool: Iterations = PIM x 2048
- For system encryption that uses SHA-512 or Whirlpool, non-system encryption and file containers: Iterations = 15000 + (PIM x 1000)
Prior to version 1.12, the security of a VeraCrypt volume was only based on the password strength because VeraCrypt was using a fixed number of iterations.
With the introduction of PIM, VeraCrypt has a 2-dimensional security space for volumes based on the couple (Password, PIM). This provides more flexibility for adjusting the desired security level while also controlling the performance of the mount/boot operation.
PIM UsageIt is not mandatory to specify a PIM.
When creating a volume or when changing the password, the user has the possibility to specify a PIM value by checking the "Use PIM" checkbox which in turn will make a PIM field available in the GUI so a PIM value can be entered.
Motivations behind using a custom PIM value can be:
- Add an extra secret parameter (PIM) that an attacker will have to guess
- Increase security level by using large PIM values to thwart future development of brute force attacks.
- Speeding up booting or mounting through the use of a small PIM value (less than 98 for system encryption that doesn't use SHA-512 or Whirlpool and less than 485 for the other cases)
The screenshots below show the step to mount a volume using a PIM equal to 231:
Changing/clearing the PIM
The PIM of a volume or for system encryption can be changed or cleared using the change password functionality. The screenshots below shows an example of changing the PIM from the empty default value to a value equal to 3 (this is possible since the password has more than 20 characters). In order to do so, the user must first tick "Use PIM" checkbox in the "New" section to reveal the PIM field.