24 reputation
1
bio website
location
age
visits member for 9 months
seen Mar 9 at 9:25

Mar
6
asked Which hardware-accelerated AES-GCM implementations support encryption in-place?
Feb
21
asked Compared to GCM or XTS modes, how secure is H xor R1, E (R2, R1, Message) for confidentiality and integrity?
Feb
20
comment Is it possible to tweak AES-GCM so that it is satisfactory for whole-disk encryption (like XTS mode)?
Thanks for the update. It seems then the approach to guarantee security with GCM is to write with a new IV each time. Then the effective data unit size that GCM operates on decides its performance, since a new (subset) write within that unit would need to rewrite the whole data under a new IV. What about adding basic fast low-level XOR operations afterward to make GCM behave less like a stream cipher? It would need to be done very carefully. But maybe the aim is to keep an update to a data region local to that "tweak", rather than to a larger "block".
Feb
19
comment Is it possible to tweak AES-GCM so that it is satisfactory for whole-disk encryption (like XTS mode)?
Thanks for the comments. As I mention below, I don't mind storing the auth tag or some key material needed to derive the IV, so space isn't an issue. But I do think it's a problem to use a sector identifier, because data ends up getting re-encrypted with the same (key,IV) when it is written to the same place. The only other alternative I'm aware of is to store a derivation of the tweak value so that data is written differently each time - which adds overhead. Given that the extra space is okay, I'd like to explore different ways I could use GCM or its components to achieve XTS properties.
Feb
19
comment Is it possible to tweak AES-GCM so that it is satisfactory for whole-disk encryption (like XTS mode)?
Thanks for the feedback. I'm wondering if you could elaborate on your answer. I understand the first two paragraphs. I'd also say that I don't mind the expansion that results. But into the third paragraph, I'm not clear on what you mean. I'm interested in knowing whether it's possible or not possible to start with (or use) GCM and achieve additional properties. It's not clear why it wouldn't be possible. I agree it would be different, and would need to be carefully done. But in principle still possible, either through the components or by using the whole GCM step in a different way.
Feb
19
awarded  Student
Feb
18
asked Is it possible to tweak AES-GCM so that it is satisfactory for whole-disk encryption (like XTS mode)?