I want to start encrypting all of my hard drives, but I don't know whether to choose XTS or GCM mode. Why is it that XTS is recommended (since the most websites I visit use GCM in their HTTPS connection)? So my question is: should I use XTS or GCM, and why is one better than the other?
$\begingroup$
$\endgroup$
0
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
6
Use XTS for whole-disk encryption. It is designed for that purpose. Definition of XTS mode in wiki is under the Disk Encryption Theory which says enough i think :)
In GCM, for a fixed key each, IV value must be distinct. This makes it disadvantageous for encryption of large files.
From an early GCM question:
GCM is bounded to encrypting about 68 GB
However, if you still want to use GCM in disk encryption, you can check this question.
-
$\begingroup$ by saying it is bounded, does it mean it latterly cannot be used for encrypting things bigger than 68? or does it becomes insecure when doing so? $\endgroup$ May 23, 2016 at 12:25
-
1$\begingroup$ It is insecure to encrypt more than $2^{39}-256$ (nearly 68 GB). Check this question about plain text size limit of GCM for more explanation $\endgroup$– MakifMay 23, 2016 at 12:32
-
1$\begingroup$ You could of course also choose EAX (which uses CMAC underneath and to my knowledge doesn't have these kind of limitations). It's also less brittle than GCM. But it has one thing going against it: it hasn't been standardized (by NIST). Depending on the implementation it may also be slower (GMAC in GCM is a fast MAC and may also be hardware accelerated using specific instructions, but EAX may use AES-NI for the MAC). $\endgroup$– Maarten Bodewes ♦May 23, 2016 at 13:12
-
1$\begingroup$ one more link, an interesting reading about XTS sockpuppet.org/blog/2014/04/30/you-dont-want-xts $\endgroup$ May 23, 2016 at 13:17
-
2$\begingroup$ @ddddavidee I seem to be having trouble reaching that page. Here's an alternative link, courtesy of the Internet Archive: web.archive.org/web/20160319151329/http://sockpuppet.org/blog/… (Also, note that the article specifically states that XTS is okay for disk encryption, which is what the OP is looking for.) $\endgroup$– userMay 23, 2016 at 13:26
$\begingroup$
$\endgroup$
2
XTS is designed so that the plaintext and ciphertext sizes are the same. This is "needed" for disk encryption in order to preserve the sector size. However, when you are encrypting your disk at the file level, this is a completely irrelevant issue. Also, XTS is not "ideal" in the sense that it's not truly a wide block cipher (defined as a pseudorandom permutation over the block size). It's a standard which is actually somewhat a compromise.
If you are encrypting at file level, then I would recommend an authenticated encryption scheme. GCM is of course possible, but you need to make sure that you have a unique IV and you need to make sure you keep within the bounds. It is possible to use a nonce-misuse resistant version as well; this is highly recommended since nonce reuse is not disastrous (at the very worst will reveal that two files are identical, but if the file includes the path name then this can't happen). You will probably be concerned about speed, but good implementations are well under a cycle a byte and so cost nothing compared to the cost of reading/writing to disk.
answered May 24, 2016 at 8:02
-
$\begingroup$ By saying that it is designed to be the same, do you mean thay it use padding to fill up the empty space left in the last block? $\endgroup$ May 24, 2016 at 8:15
-
1$\begingroup$ No. I mean that if you encrypt a completely full sector then the ciphertext size is a full sector. When doing (low level) disk encryption you encrypt entire sectors irrespective of their content, and then you want the result to be size of a sector. $\endgroup$ May 24, 2016 at 8:52