6
$\begingroup$

I could not find in the NIST recommendations on XTS how many blocks can securely be encrypted with XTS-AES.

Through the recommendations, I've found:

The length of the data unit for any instance of an implementation of XTS-AES shall not exceed $2^{20}$ AES blocks.

The specification cited in NIST The XTS-AES Tweakable Block Cipher states:

The number of 128-bit blocks in the data unit shall not exceed $2^{128}-2$. The number of 128-bit blocks should not exceed $2^{20}$.

From what I understood, data units are sectors, so a sector can have at most $2^{128}-2$ blocks but you can only encrypt $2^{20}$ blocks which cannot be correct (it seems too little compared to a disk's capacity).

Improve this question
$\endgroup$
3
  • $\begingroup$ Where can you find that in the specs? I don't see it in the NIST requirements. I see the $2^{20}$ in there, but I've been looking in vain for $2^{128-2}$ or $2^{128}-2$ blocks. $\endgroup$
    – Maarten Bodewes ♦
    May 17, 2016 at 21:12
  • 1
    $\begingroup$ Sorry, it was some other paper from the bibliography The XTS-AES Tweakable Block Cipher grouper.ieee.org/groups/1619/email/pdf00086.pdf $\endgroup$
    – berendeanicolae
    May 17, 2016 at 21:19
  • 3
    $\begingroup$ I'd guess that $2^{128}-2$ blocks is the logical limit and that $2^{20}$ blocks is the limit for practical security. I can see a mention of $2^{40}$ in appendix D of the IEEE P1619 standard giving a probability of an issue of $1/{2^{57}}$. It could well be that they were aiming for approx. $1/{2^{114}}$ instead. But that's just guessing. $\endgroup$
    – Maarten Bodewes ♦
    May 17, 2016 at 21:49

1 Answer 1

Reset to default
4
$\begingroup$

From what I understood, data units are sectors, so a sector can have at most $2^{128}-2$ blocks but you can only encrypt $2^{20}$ blocks which cannot be correct (it seems too little compared to a disk's capacity).

The data unit is the sector, yes, but both of those quotes only talk about the length of a single data unit. The larger number in the latter reference ("shall not"), is an absolute bound, while the second ("should not") is a recommendation.

The recommendation from the second reference is that a sector should be no larger than $128 \cdot 2^{20}$ bits, i.e. 16 MiB. SP 800-38E makes this recommendation a requirement:

The length of the data unit for any instance of an implementation of XTS-AES shall not exceed $2^{20}$ AES blocks. Note that Subclause 5.1 of Ref.[2] recommends this limit but does not require it.

(The ref above is to the IEEE standard based on the draft spec you linked.)

The total disk capacity encrypted can be much larger, since it consists of many sectors. For recommendations, you can see appendix D.4 of the second specification, where $2^{36}$ and $2^{40}$ (1 TiB and 16 TiB) AES blocks are mentioned.

Improve this answer
$\endgroup$
2
  • $\begingroup$ I'm however still wondering how that $2^{20}$ was calculated. $\endgroup$
    – Maarten Bodewes ♦
    May 18, 2016 at 8:13
  • 1
    $\begingroup$ @MaartenBodewes, I think it's just for compatibility/interoperability, rather than calculated in any way: "an implementation of XTS-AES may further restrict the length of the data units for any key [...] Restrictions on the supported lengths of the key or the data units may affect interoperability with other implementations." $\endgroup$
    – otus
    May 18, 2016 at 8:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.