Hot answers tagged

4

Use XTS for whole-disk encryption. It is designed for that purpose. Definition of XTS mode in wiki is under the Disk Encryption Theory which says enough i think :) In GCM, for a fixed key each, IV value must be distinct. This makes it disadvantageous for encryption of large files. From an early GCM question: GCM is bounded to encrypting about 68 GB ...


4

No, it's recommended to use a well described KBKDF (key based Key Derivation Function). If you like counters you could try NIST SP 800-108 section 5.1: KDF in Counter Mode. But note that it doesn't use Counter Mode encryption; rather than that it uses a counter combined with a PRF: HMAC or CMAC. If you use CMAC you could still use AES (or any other secure ...


4

As Maarten Bodewes points out, you should use a known key derivation function instead of this method (i.e. don't roll your own crypto). Having said that we can still try to understand what happens if you do use this method. I assume that the method you're describing is something as follows. You take a block cipher $E:\mathsf{K}\times \mathsf{X} \to ...


3

XTS is designed so that the plaintext and ciphertext sizes are the same. This is "needed" for disk encryption in order to preserve the sector size. However, when you are encrypting your disk at the file level, this is a completely irrelevant issue. Also, XTS is not "ideal" in the sense that it's not truly a wide block cipher (defined as a pseudorandom ...


3

From what I understood, data units are sectors, so a sector can have at most $2^{128}-2$ blocks but you can only encrypt $2^{20}$ blocks which cannot be correct (it seems too little compared to a disk's capacity). The data unit is the sector, yes, but both of those quotes only talk about the length of a single data unit. The larger number in the latter ...



Only top voted, non community-wiki answers of a minimum length are eligible