I'm working on software that should eventually result in a crypto file system similar to encfs. So far, i have a user password that goes through PBKDF2 using
with SHA-512 and a couple of thousand rounds to generate the Key Encryption Key. The Data Encryption Key and IV are random on a per-file basis with
DEK encrypted with KEK and the IV are written to the file header. So far so good.
For file encryption, I use a configurable block size of 512, 1024, ... 4096 bytes to split write requests into chunks and encrypt each chunk with AES. The mode however depends on various parameters and is not the same all the time. Right now I'm using CBC mode to maintain backwards compatibility, but esp. for random writes, CBC is somewhat ''clumsy'' to handle, so I want to switch to a different mode like GCM. Before I start coding, I have two questions:
Because GCM also offers AEAD, I want to keep the 512, 1024, .. blocks and use a per-block AAD and store the tag in the file. This allows me to fail early during decryption. What should I use for the AAD?
My per-block IVs (nonces for GCM) are generated using ESSIV: IV_n = AES(sha-512(DEK), block number) with Key = DEK and IV = per--file IV for AES, truncated to whatever IV size is used. Is that OK?
Hope I'm not completely off track ...