You take something like chacha20 and use the disk block # to seek it, xor it with the data block and then encrypt it with a block cipher in ECB mode.

Would this be secure?


To avoid getting bogged down in implementation pitfalls lets consider an ideal scenario:

You have a constant size file (that is a multiple of block cipher size) that may get altered through time. Using a stream cipher to encrypt is therefore not secure under some threat models. So you combine a stream cipher with an ECB mode block cipher - through chaining, first xor with stream cipher output then pass through block cipher. Would this now be more secure? As secure as XEX/XTS?

  • 2
    $\begingroup$ Seeking and tweaking is not exactly the same thing. Could you describe your scheme more formally? $\endgroup$
    – Maarten Bodewes
    Dec 11, 2018 at 18:01
  • $\begingroup$ Agreed the title doesn't seem to fit with the body of the question. Even considering only the question and not the title, there seems to be an issue that would need work. It looks like this is a makeshift CTR mode where the block # is the counter, but with XOR instead of concatenation. If the disk block is not exactly the same size as the blocks used in a given block cipher, that would be an issue. I always think of Chacha20 as a stream cipher though. $\endgroup$
    – WDS
    Dec 11, 2018 at 18:50
  • $\begingroup$ So basically ECB mode, using a stream cipher for whitening instead of a real mode? $\endgroup$
    – forest
    Dec 12, 2018 at 6:39
  • $\begingroup$ @forest basically yes $\endgroup$
    – user64218
    Dec 12, 2018 at 7:05
  • $\begingroup$ So an attacker would be limited to 16 bytes of malleability (as with XTS), and you have to pay the price with double the performance impact. You know, XTS internally works a lot like what you describe, but much more efficiently. It uses ECB, with a stream cipher-like function generating a random "whitening" stream for ECB encryption which requires only one block cipher call per sector. Is there a reason you can't use XTS? $\endgroup$
    – forest
    Dec 12, 2018 at 7:06


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.