Recently, I've been working on disk encryption. I started with the AES-XTS mode which is the standard for this purpose and tried to understand the concept of disk encryption in general.
I know that AES-XTS is preferable from many aspects for disk encryption as long as authentication is not requested. You don't need to store additional data for an authentication tag or IV and it is more resistant against malleability. However, this resistance is not sufficient for proper authentication since an attacker can still make changes on data without being detected.
In this conncept, I reviewed the IEEE Std 1619.1-2018 document which is the IEEE Standard for Authenticated Encryption with Length Expansion for Storage Devices. The cryptographic modes of operation allowed as alternatives by this standard are given in Table 1. Again, the parameter limits of these modes are shown in Table 2. I think these mods are not much different from each other in terms of performance - maybe I'm wrong- . Could you compare these modes in terms of security? If you had a choice from this table, which one would you choose? If your choice depends on usage scenarios, which one would you choose under what conditions?