# Should I use XTS or GCM to encrypt my hard drives?

I want to start encrypting all of my hard drives, but I don't know whether to choose XTS or GCM mode. Why is it that XTS is recommended (since the most websites I visit use GCM in their HTTPS connection)? So my question is: should I use XTS or GCM, and why is one better than the other?

Use XTS for whole-disk encryption. It is designed for that purpose. Definition of XTS mode in wiki is under the Disk Encryption Theory which says enough i think :)

In GCM, for a fixed key each, IV value must be distinct. This makes it disadvantageous for encryption of large files.

From an early GCM question:

GCM is bounded to encrypting about 68 GB


However, if you still want to use GCM in disk encryption, you can check this question.

• by saying it is bounded, does it mean it latterly cannot be used for encrypting things bigger than 68? or does it becomes insecure when doing so? May 23 '16 at 12:25
• It is insecure to encrypt more than $2^{39}-256$ (nearly 68 GB). Check this question about plain text size limit of GCM for more explanation May 23 '16 at 12:32
• You could of course also choose EAX (which uses CMAC underneath and to my knowledge doesn't have these kind of limitations). It's also less brittle than GCM. But it has one thing going against it: it hasn't been standardized (by NIST). Depending on the implementation it may also be slower (GMAC in GCM is a fast MAC and may also be hardware accelerated using specific instructions, but EAX may use AES-NI for the MAC). May 23 '16 at 13:12