I stumbled across a VPN website when looking up information about XTS, and came across their own explanation of different block modes (basically the ECB penguin, but with their company logo instead). What stood out to me was their XTS example, where their logo still shows through:


It clearly is visible here. However, as far as I am aware, a distinguishing attack on XTS implies a distinguishing attack on the underlying cipher. Given their rather simplistic (or inaccurate) descriptions of other block modes, I would not be surprised if they made a mistake in their testing procedure. They claimed all of the images they provided were created using the openssl utility.

How could they possibly have come up with this bitmap using XTS?

XTS is a tweakable narrow-block cipher mode with ciphertext stealing. Ignoring the ciphertext stealing (which makes it functionally equivalent to XEX with two keys), the block mode is defined as

\begin{align} T &= E_{K_2}(i) \otimes \alpha^j\\ C &= E_{K_1}(P \oplus T) \oplus T \end{align}

where $K_2$ is the tweak key, $K_1$ is the main key, $i$ is the sector number, $j$ is the block number, and $\alpha$ is the primitive element of $\operatorname{GF}(2^{128})$ defined by polynomial $x$, i.e. the number 2. $\otimes$ is modular multiplication of two polynomials over the binary field $\operatorname{GF}(2)$, modulo $x^{128} + x^7 + x^2 + x + 1$.

Things can go wrong if $j = 0$ (in XEX) or if the same $i$ is re-used for multiple sectors.

  • 5
    $\begingroup$ I suspect that they may have misused XTS, possibly by treating each block as a separate plaintext, and encrypting them all with the same $i$ (rather than using different $i$'s, or encrypting the entire thing as a large plaintext) $\endgroup$ – poncho May 2 '18 at 12:58
  • $\begingroup$ They claim to have shared their methodology. Have you tried (fixing the bugs in their invocations of openssl and) reproducing their results? If not, try it and report back! $\endgroup$ – Squeamish Ossifrage May 2 '18 at 13:57
  • $\begingroup$ @SqueamishOssifrage They didn't mention exactly how they used openssl, only for their sample with CBC. The other mods can have different options. $\endgroup$ – forest May 4 '18 at 1:04
  • $\begingroup$ @forest What happens if you replace CBC by XTS in that openssl enc invocation? (You may also need to insert hyphens: openssl enc -aes-128-xts ....) $\endgroup$ – Squeamish Ossifrage May 4 '18 at 1:15
  • $\begingroup$ Tried to at least. Only system with openssl right now is a shell server that just went down. Perhaps later today I'll be back on my real *nix machine. $\endgroup$ – forest May 4 '18 at 1:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.