Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm working on software that should eventually result in a crypto file system similar to encfs. So far, i have a user password that goes through PBKDF2 using


with SHA-512 and a couple of thousand rounds to generate the Key Encryption Key. The Data Encryption Key and IV are random on a per-file basis with


DEK encrypted with KEK and the IV are written to the file header. So far so good.

For file encryption, I use a configurable block size of 512, 1024, ... 4096 bytes to split write requests into chunks and encrypt each chunk with AES. The mode however depends on various parameters and is not the same all the time. Right now I'm using CBC mode to maintain backwards compatibility, but esp. for random writes, CBC is somewhat ''clumsy'' to handle, so I want to switch to a different mode like GCM. Before I start coding, I have two questions:

  • Because GCM also offers AEAD, I want to keep the 512, 1024, .. blocks and use a per-block AAD and store the tag in the file. This allows me to fail early during decryption. What should I use for the AAD?

  • My per-block IVs (nonces for GCM) are generated using ESSIV: IV_n = AES(sha-512(DEK), block number) with Key = DEK and IV = per--file IV for AES, truncated to whatever IV size is used. Is that OK?

Hope I'm not completely off track ...

share|improve this question
I don't know why you are implementing an encrypted file system, but there are specific modes of encryption that have been created with FS encryption in mind. Neither GCM nor CBC seem very compelling for FS encryption to me. Have you looked at existing solutions? – Maarten Bodewes Jan 21 '14 at 0:20
You should read this page to get some hints on modes that are intended for file system encyption. You'll have better performances and security. other good resource: – ddddavidee Jan 21 '14 at 9:44

The usual mode for disk encryption is XTS (let's say the mode suggested by the NIST). AEAD cipher seems to be promissing but typically with the GCM you will have also to store an authentication tag per encrypted block which may lead to a complex implementation (but interesting). I believe that regarding at least integrity, there exist "new" file systems which handle this (to be check on linux side).

share|improve this answer
re least authority: website, paper. – figlesquidge Jan 21 '14 at 13:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.