5
$\begingroup$

I have a disk on which each sector can only be written once (like a journal, only appending is possible). Unused sectors are reported as being filled with zeroes, while used sectors should not be readable without authentication (achieved over a separate channel with the drive).

Since an attacker can never gather two ciphertexts for the same block, is there any advantage of using AES-XTS over AES-CTR? If not, should I still use AES-XTS, since it makes it clear that we are effectively dealing with FDE (although in a write-once fassion) and reviewers might (correctly) argue that CTR should not be used for FDE? Or should I use AES-CTR, because its security guarantees are proven better?

The goal is to make it possible to send the encrypted data to the manufacturer (who also holds the key) in case the password is lost to allow data recovery (which is a regulatory requirement). Each disk uses a unique key.

EDIT: this is not a duplicate of Why do we use XTS over CTR for disk encryption?, because I am concerned about write-once storage, not a regular disk drive that will be overwritten with different data regularly, thus the attack surface is very different.

Improve this question
$\endgroup$
6
  • 1
    $\begingroup$ Does Why do we use XTS over CTR for disk encryption? help you? $\endgroup$
    – kelalaka
    Dec 4, 2018 at 14:10
  • $\begingroup$ As a side-note, it says 'If the only threat is that the disk is stolen, so that an adversary will only ever obtain one version of the ciphertext and no more plaintext will ever be encrypted after that, then I don't think there's any benefit in using XTS over CTR.' This would exactly be the case for me, as there is no way for a sector to be modified. An attacker can only take a snapshot of blocks 1-10 and then 1-20, but on the second attempt, sectors 1-10 will still be the same. My question focuses on whether I should STILL use XTS although I might not need it. $\endgroup$
    – nioncode
    Dec 4, 2018 at 14:14
  • 1
    $\begingroup$ Possible duplicate of Why do we use XTS over CTR for disk encryption? $\endgroup$
    – Gilles 'SO- stop being evil'
    Dec 4, 2018 at 16:33
  • $\begingroup$ Because its security guarantees are proven better If I recall, XTS has some proofs regarding distinguishability and the like. For the sake of data-at-rest encryption, there is no doubt as to the confidentiality it applies. $\endgroup$
    – forest ♦
    Dec 5, 2018 at 2:26
  • $\begingroup$ nioncode, please indicate if the answer of Gilles applies or not. Without indication why it isn't sufficient I'm inclined to close it. $\endgroup$
    – Maarten Bodewes ♦
    Dec 5, 2018 at 15:14

1 Answer 1

Reset to default
1
$\begingroup$

Analyzing the risks and correctly setting the threat model is important when choosing the encryption schemes.

If the attacker is a passive attacker, that he can only read the hard disk while transmitted, as it pointed out in the comparison of the XTS vs CTR question, there is no benefit against for passive attacker.

When the attacker, however, is an active attacker you will need authentication. CTR and XTS modes are not authenticated encryption modes. In CTR mode, when the attacker modified a bit the ciphertext will turn into a valid plaintext. It is also possible in XTS mode, a little harder to achieve. To mitigate, you can hash the whole disk and then apply a digital signature on it. The signature can be transmitted over another channel.

You can see a discussion here Why not authenticate full-disk encryption? about integrating the authentication into a filesystem.

Improve this answer
$\endgroup$
7
  • $\begingroup$ The plaintext data has authenticity (based on signatures) built-in, so tampering will be noticed after decryption. $\endgroup$
    – nioncode
    Dec 4, 2018 at 16:33
  • $\begingroup$ What if the attacker, copies one disk, and write into the next one? $\endgroup$
    – kelalaka
    Dec 4, 2018 at 16:34
  • $\begingroup$ Writing is only possible after authentication. If the attacker has access during that time, it is possible to read the entire data in plaintext anyways. Also, it is then possible to add new data, but this is not a security requirement. $\endgroup$
    – nioncode
    Dec 4, 2018 at 16:35
  • 1
    $\begingroup$ I've given the answer for two types of the attacker. If an attacker can copy the HD while in transit, for the next transit, he can write into as replay attack. $\endgroup$
    – kelalaka
    Dec 4, 2018 at 16:38
  • $\begingroup$ But this is possible for both, CTR and XTS, correct? So there is no difference. $\endgroup$
    – nioncode
    Dec 5, 2018 at 9:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.