2
$\begingroup$

I'm working on software that should eventually result in a crypto file system similar to encfs. So far, i have a user password that goes through PBKDF2 using

PKCS5_PBKDF2_HMAC

with SHA-512 and a couple of thousand rounds to generate the Key Encryption Key. The Data Encryption Key and IV are random on a per-file basis with

RAND_bytes

DEK encrypted with KEK and the IV are written to the file header. So far so good.

For file encryption, I use a configurable block size of 512, 1024, ... 4096 bytes to split write requests into chunks and encrypt each chunk with AES. The mode however depends on various parameters and is not the same all the time. Right now I'm using CBC mode to maintain backwards compatibility, but esp. for random writes, CBC is somewhat ''clumsy'' to handle, so I want to switch to a different mode like GCM. Before I start coding, I have two questions:

  • Because GCM also offers AEAD, I want to keep the 512, 1024, .. blocks and use a per-block AAD and store the tag in the file. This allows me to fail early during decryption. What should I use for the AAD?

  • My per-block IVs (nonces for GCM) are generated using ESSIV: IV_n = AES(sha-512(DEK), block number) with Key = DEK and IV = per--file IV for AES, truncated to whatever IV size is used. Is that OK?

Hope I'm not completely off track ...

Improve this question
$\endgroup$
2
  • $\begingroup$ I don't know why you are implementing an encrypted file system, but there are specific modes of encryption that have been created with FS encryption in mind. Neither GCM nor CBC seem very compelling for FS encryption to me. Have you looked at existing solutions? $\endgroup$
    – Maarten Bodewes ♦
    Jan 21, 2014 at 0:20
  • $\begingroup$ You should read this page en.wikipedia.org/wiki/XEX-TCB-CTS to get some hints on modes that are intended for file system encyption. You'll have better performances and security. other good resource: truecrypt.org/docs/modes-of-operation $\endgroup$
    – ddddavidee
    Jan 21, 2014 at 9:44

1 Answer 1

Reset to default
3
$\begingroup$

The usual mode for disk encryption is XTS (let's say the mode suggested by the NIST). AEAD cipher seems to be promissing but typically with the GCM you will have also to store an authentication tag per encrypted block which may lead to a complex implementation (but interesting). I believe that regarding at least integrity, there exist "new" file systems which handle this (to be check on linux side).

Improve this answer
$\endgroup$
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.