# AES mode for file encryption

I'm working on software that should eventually result in a crypto file system similar to encfs. So far, i have a user password that goes through PBKDF2 using

PKCS5_PBKDF2_HMAC


with SHA-512 and a couple of thousand rounds to generate the Key Encryption Key. The Data Encryption Key and IV are random on a per-file basis with

RAND_bytes


DEK encrypted with KEK and the IV are written to the file header. So far so good.

For file encryption, I use a configurable block size of 512, 1024, ... 4096 bytes to split write requests into chunks and encrypt each chunk with AES. The mode however depends on various parameters and is not the same all the time. Right now I'm using CBC mode to maintain backwards compatibility, but esp. for random writes, CBC is somewhat ''clumsy'' to handle, so I want to switch to a different mode like GCM. Before I start coding, I have two questions:

• Because GCM also offers AEAD, I want to keep the 512, 1024, .. blocks and use a per-block AAD and store the tag in the file. This allows me to fail early during decryption. What should I use for the AAD?

• My per-block IVs (nonces for GCM) are generated using ESSIV: IV_n = AES(sha-512(DEK), block number) with Key = DEK and IV = per--file IV for AES, truncated to whatever IV size is used. Is that OK?

Hope I'm not completely off track ...

• I don't know why you are implementing an encrypted file system, but there are specific modes of encryption that have been created with FS encryption in mind. Neither GCM nor CBC seem very compelling for FS encryption to me. Have you looked at existing solutions? – Maarten Bodewes Jan 21 '14 at 0:20
• You should read this page en.wikipedia.org/wiki/XEX-TCB-CTS to get some hints on modes that are intended for file system encyption. You'll have better performances and security. other good resource: truecrypt.org/docs/modes-of-operation – ddddavidee Jan 21 '14 at 9:44