# How many blocks can securely be encrypted with XTS

I could not find in the NIST recommendations on XTS how many blocks can securely be encrypted with XTS-AES.

Through the recommendations, I've found:

The length of the data unit for any instance of an implementation of XTS-AES shall not exceed $2^{20}$ AES blocks.

The specification cited in NIST The XTS-AES Tweakable Block Cipher states:

The number of 128-bit blocks in the data unit shall not exceed $2^{128}-2$. The number of 128-bit blocks should not exceed $2^{20}$.

From what I understood, data units are sectors, so a sector can have at most $2^{128}-2$ blocks but you can only encrypt $2^{20}$ blocks which cannot be correct (it seems too little compared to a disk's capacity).

• Where can you find that in the specs? I don't see it in the NIST requirements. I see the $2^{20}$ in there, but I've been looking in vain for $2^{128-2}$ or $2^{128}-2$ blocks. May 17 '16 at 21:12
• Sorry, it was some other paper from the bibliography The XTS-AES Tweakable Block Cipher grouper.ieee.org/groups/1619/email/pdf00086.pdf May 17 '16 at 21:19
• I'd guess that $2^{128}-2$ blocks is the logical limit and that $2^{20}$ blocks is the limit for practical security. I can see a mention of $2^{40}$ in appendix D of the IEEE P1619 standard giving a probability of an issue of $1/{2^{57}}$. It could well be that they were aiming for approx. $1/{2^{114}}$ instead. But that's just guessing. May 17 '16 at 21:49

From what I understood, data units are sectors, so a sector can have at most $2^{128}-2$ blocks but you can only encrypt $2^{20}$ blocks which cannot be correct (it seems too little compared to a disk's capacity).

The data unit is the sector, yes, but both of those quotes only talk about the length of a single data unit. The larger number in the latter reference ("shall not"), is an absolute bound, while the second ("should not") is a recommendation.

The recommendation from the second reference is that a sector should be no larger than $128 \cdot 2^{20}$ bits, i.e. 16 MiB. SP 800-38E makes this recommendation a requirement:

The length of the data unit for any instance of an implementation of XTS-AES shall not exceed $2^{20}$ AES blocks. Note that Subclause 5.1 of Ref. recommends this limit but does not require it.

(The ref above is to the IEEE standard based on the draft spec you linked.)

The total disk capacity encrypted can be much larger, since it consists of many sectors. For recommendations, you can see appendix D.4 of the second specification, where $2^{36}$ and $2^{40}$ (1 TiB and 16 TiB) AES blocks are mentioned.

• I'm however still wondering how that $2^{20}$ was calculated. May 18 '16 at 8:13
• @MaartenBodewes, I think it's just for compatibility/interoperability, rather than calculated in any way: "an implementation of XTS-AES may further restrict the length of the data units for any key [...] Restrictions on the supported lengths of the key or the data units may affect interoperability with other implementations."
– otus
May 18 '16 at 8:34