I'm trying to make a local command-line based password manager. So far, I've managed to make the output look dizzy on tty, and I plan to encode user credentials in individual 512-byte blocks.
To encrypt these blocks, I thought about using XTS, but the overhead of "tweaks" just makes it less favorable compared to the key wrapping modes in NIST.SP.800-38F.
But the key-wrapping in NIST.SP.800-38F involves splitting blocks in halves into "semi-blocks", which is a bit off-putting, and implementing it in full would mean the complication of various working variables.
So instead I made an ad-hoc design.
In 2CBC mode, the plaintext goes through two rounds of encryption.
In the first round, AES-CBC is applied to the data with an all-zero IV, and because the chaining of cipher output, we can be sure that the result of the last block depends on all previous blocks.
In the second round, AES-CBC is applied again, but this time, with the last block from first round as IV, and because IV is the output of a cipher, we can be sure that it's suitably random, and because it's the output of chain of cipher, we can be sure it'd depend on all parts of the input.
I feel it'd be easier to implement 2CBC than AES-KW.
On Integrity and Semantic Security.
Because the block is large enough for the type of data it holds, it is possible to have dedicated area in the content of the 512-byte block for randomization vector and integrity check value.
Specifically, the last 128 bits will have 1.) a 96-bit randomization value, 2.) a CRC32 checksum of all previous 508 bytes.
However, I do not see a reason why message authentication is needed, as it's data at rest mostly.
However, I'm not sure if this is sufficient for the use case here. Specifically, what kind of adversary do I need to prevent tempering of the records from, and how.
Are my arguments enough to claim that 2CBC is secure for just confidentiality? Or I've made a terrible mistake and missed something important?
If I want to add integrity, can I do it the same way as extending KW from W?
Does the randomization value have to be unpredictable? Can I have meaningful information such as modification time on it? (Probably not, since if attacker checks mod time of the file, he/she will know there's some known plaintext in the file).
How should the need for authenticating the records be satisfied?