What are the currently recommended modes of encryption for large disks? Basic requirements would seem to be that you can update an encrypted sector independently of others, which rules out most standard modes of operation except CTR. For example are there any problems with taking the counter to be the current block number + some initial offset that could be stored for example on the first block.

What security models are usually considered for disk encryption? Is IND-CPA-security (as offered by CTR) enough?

  • $\begingroup$ XTS is one of the most popular modes. See Disk encryption theory on wikipedia. $\endgroup$ – CodesInChaos Nov 19 '14 at 12:24
  • $\begingroup$ CTR is not a good idea since an attacker who sees two versions of a block can attack it with the usual many-time-pad attacks. This can happen due to SSD wear leveling. $\endgroup$ – CodesInChaos Nov 19 '14 at 12:26
  • $\begingroup$ CodesInChaos, any pointer to this attack and context? I'm really interested $\endgroup$ – ddddavidee Nov 19 '14 at 14:22
  • $\begingroup$ @CodesInChaos: Thanks for the latter comment. I would really appreciate it, if you could turn your comment into an answer and include links to the relevant publications. The wikipedia article is a little light on technical details, especially on attacks. $\endgroup$ – JT1 Nov 19 '14 at 17:06

The standard for full-disk encryption (FDE) is XTS mode or ESSIV-AES-CBC.

XTS tweaks each block within each sector differently (and hence avoids ECB's problems) and is considered the best choice available at the moment.

ESSIV-AES-CBC works by using AES-CBC with the IV being the hash of the sector index. The problem with this mode is that you can flip bits at arbitrary positions if you can accept the previous block being "destroyed"(completely scrambled), which you can very often. F.ex. one could tweak down attack security critical bits and hence compromise the online-security of the system.

CTR would be a really bad idea for disk-encryption as you'd have the same problems as with CBC but you'd also loose "poor-man's-authentication" (-> at least one block gets scrambled), as you can know flipped bits at arbitrary positions without any problems.

What would be optimal for disk encryption would be a mode that turns a small block blockcipher (->AES) into a very large block cipher without too much speed penalties. (2 calls at max) That's was Bitlocker's elephant diffuser tried.

The best solution in my eyes would be to simply have a blockcipher with a very large blocksize that is considered secure. In my personal opinion, Threefish(-512/-1024) would be a nicer option than AES, but it isn't adopted.

You might be interested in this.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.