I am developer of an application that uses XTS with ciphers which use 128-bit blocks (AES, Serpent and Twofish).

I now want to use XTS with a cipher which uses 256-bit blocks (Shacal-2). AFAIK, I just have to extend the tweak to a 256-bit value. But what to do with the multiplication of the tweak? Should I keep the 0x87 constant, and use it depending on the carry of the 256-bit value (bit 255)? But in this case, should I do something about the bit 127?

  • 1
    $\begingroup$ You probably need a new constant that describes an irreducible 256 bit polynomial, instead of a 128 bit polynomial. But I'll leave the details to somebody who actually understands binary fields. $\endgroup$ – CodesInChaos May 21 '16 at 16:42
  • $\begingroup$ Funfact: If you do anything not described in the XTS-Standard or Specification, you are no longer allowed to call it XTS until it is standardized as such or added to the standard. $\endgroup$ – SEJPM May 21 '16 at 19:10
  • 1
    $\begingroup$ XTS uses the same binary field polynomial as GCM internally. The task is now to find the properties of the polynomial $x^{128}+x^7+x^2+x+1$ (e.g. whether it is irreducable, primitive and / or minimal) and expand this set of properties to the 256-bit case. Also see poncho's answer on the related GCM question. $\endgroup$ – SEJPM May 21 '16 at 19:36
  • $\begingroup$ @SEJPM: Thanks. Your link suggests that I could simply use 0x425 as a 256-bit constant. This book (books.google.fr/books?id=SySsBAAAQBAJ) also claims that x^256+x^10+x^5+x^2+1 is irreducible. So, this may be the solution. $\endgroup$ – v77 May 21 '16 at 21:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.