What is the best mode of operation for file encryption with Threefish512?

Question

In Cryptography Engineering Bruce recommends using "rand IV CBC mode" but the copy of the book I have is from 2003 and I am unsure if this is still a recommended practice with all the recent attacks discovered on various CBC implementations.

Is there a better choice then CBC mode?

I am writing a program that will be using a block cipher to encrypt a file locally. This is for a personal academic project.

Assume the following

• The block Cipher I am using is Threefish512 so GCM is not viable as it is only defined for 128-bit block ciphers
• The block cipher I am using is not supported by any modern crypto libraries (I am aware of) so I will be implementing this mode of operation myself
• The file is relatively small and the encryption/decryption of it is only done periodically so security is preferred over speed and parallelization ability
• The computer doing the encryption has not been physically compromised
• I have access to truly random numbers for IV generation
• This encryption will not be part of direct network communications so an attacker will not have access to input whatever they want into the cipher.
• A mode that offers authentication is preferred
• The details required to implement this mode of operation are in the public domain and not encumbered by any software patents

Answer 1

You should use an authenticated encryption mode.

My personal current favorite is SIV mode, originally introduced by Rogaway & Shrimpton (2006) and standardized (for use with AES) in RFC 5297.

The major advantage of modes based on the SIV construction (such as SIV mode itself, as well as e.g. GCM-SIV) is that, unlike most other encryption modes, their security will not fail catastrophically even if the nonce/IV is accidentally reused. This eliminates one of the few remaining "weak points" of modern authenticated encryption modes. CBC mode also has this property to a limited extent, which I believe is the main reason why Schneier's book recommends it, but SIV is much better in that regard, and, as an authenticated encryption mode, also resistant to a much wider range of attacks.

---

The main disadvantage of SIV mode is that it's a two-pass mode: encryption requires first computing a MAC over the plaintext, and then using that MAC output as a "synthetic IV" to encrypt the data. If you want to encrypt large files, you may wish to use a "chunked SIV" mode. There is, as far as I know, (unfortunately) no standard for that, but the basic idea is to:

1. Split your file into chunks of, say, 1 MB.
2. Encrypt each chunk using SIV mode, and concatenate the resulting ciphertexts.
3. For each chunk, include any relevant parameters such as the total size of the file, the chunk size used, the number of the current chunk and, importantly, the "synthetic IV" of the previous chunk as associated data. (At a minimum, if you don't know the size of the file in advance, each chunk should have as associated data its number, the previous chunk's synthetic IV and a flag indicating whether or not this is the last chunk.)

This "SIV chaining" should ensure that, if every chunk of the encrypted file can be successfully decrypted, this not only guarantees the integrity of the individual chunks, but also of the entire file (i.e. that no chunks have been added, removed or switched around).