I'm looking to do file encryption of a bunch of individual files, some small, some quite large. The files will be write-once/read-many, so I could use CBC, however, since the read-access needs to have seekability, XTS seems a better fit. One issue, as I understand it, is that XTS (or CBC for that matter) is malleable... i.e. if the encrypted cipher text is modified, an attacker could potentially do some targeted things to files. So I was thinking surely this problem is already solved but it wasn't clear to me what the standard was, if any. Performance is a concern, so one thought I had was simply running a CRC on each XTS sector and including the CRC result in the plaintext for encryption of that XTS sector (e.g. just expand each sector by the 4 octets). Thus, if anything in the sector was modified by an attacker, the decrypt would fail (i.e. the CRC wouldn't likely match). Is there a smarter way, or a standard that's "fast"?
EDIT: it occurs to me that if the files are rewritable (which currently they are not) a CRC on each cluster in XTS mode is still open to an attack where an attacker can guess at the plaintext and write a cluster to a known location in the file and see if it matches the cluster that's already there. Only way to prevent that is to have a random IV per block as well, that changes per write, I think.