XTS-AES uses two keys $(k_1, k_2)$, which are obtained from a concatenated key $k$. Does this key $k$ remain same for the whole disk or changes per sector?

  • $\begingroup$ I can't write a full answer right now: $k$ remains the same for the whole disk. $\endgroup$
    – SEJPM
    Oct 23 '15 at 7:22

To answer the question we first need to take a quick look at how XTS encrypts data:


With $\oplus$ denoting bitwise XOR, $n$ denoting the sector index, $i$ denoting the block index within the sector. $\alpha$ is a polynomial in the $GF(2^{128})$ and is exponentiated appropriately and multiplied ($\otimes$) with the encrypted sector index.

As you can see you don't need to alter either the key $k_1$ or $k_2$ for each sector as the indices will introduce a unique whitening value for each block.

  • $\begingroup$ won't the behavior be similar to two-time-pad, which is considered bad for cryptography? $\endgroup$
    – Baruntar
    Oct 27 '15 at 1:42
  • $\begingroup$ @Baruntar, no as 1) you don't want to achieve perfect secrecy here (which two-time-pad can't provide) and 2) this is basically ECB mode (also bad) but with different whitening for each block (making it good). $\endgroup$
    – SEJPM
    Oct 27 '15 at 17:19
  • $\begingroup$ but still the whitening of each block remains same over a prolonged period of time. Also you mentioned the aim was not to attain perfect secrecy. Can you provide reasons for the argument? I thought purpose of disk encryption would be to provide secrecy. $\endgroup$
    – Baruntar
    Oct 28 '15 at 4:09
  • $\begingroup$ @Baruntar, secrecy? yes. Perfect Secrecy? no. Perfect secrecy means you can't learn anything about the plaintext except from what you already know even with infinite computing power. "Normal" secrecy restricts this to "reasonable" (polynomially bounded) power. And yes, the whitening will stay the same over time but this only tells you the block has changed and not the value it has changed to. XTS is not perfect (it's unauthenticated and lacks randomization) but it's the best we have at the moment for FDE. $\endgroup$
    – SEJPM
    Oct 28 '15 at 16:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.