1
$\begingroup$

have few more questions about disk encryption with AES cipher:

Do we consider all zeros (0000000) as empty block of data or is it still a data?

Do we really need padding to the data blocks if a disk sector is multiplication of data block?

Also if one data block is empty (all 000000) why we just dont apply encryption on that block as usual?

Most of the disk encryption software let us to encrypt used space vs full disk. In case of full disk , how is the empty space being encrypted with AES?

is disk encryption always encrypt data into same location? lets say data from sector 200 will always land after encryption in sector 200? (assuming that we are not adding any HMAC which expands the data).

Does AES keep track which sector of disk is encrypting? Or this info is irrelevant for encryption? I think bitlocker in CBC mode adds IV as encrypted sector number - but is it to keep track on sector number or just to randomize the input (instead of sector number they could just add any random number)

$\endgroup$
2
$\begingroup$

Do we consider all zeros (0000000) as empty block of data or is it still a data?

Either it is a block of data or it isn't, there is no such thing as an "empty block". And yes, it is still data (data is always plural), as it has certain properties such as a size. For AES it needs to be 16 bytes of any value to be considered one block of data.

Do we really need padding to the data blocks if a disk sector is multiplication of data block?

No, in most disk encryption protocols padding is not required (and the problem is where to store the encrypted block of padding as it doesn't fit in the sector).

Also if one data block is empty (all 000000) why we just dont apply encryption on that block as usual?

As indicated, it is not empty, and we would use encryption as usual.

Most of the disk encryption software let us to encrypt used space vs full disk. In case of full disk , how is the empty space being encrypted with AES?

Just like always. Note that empty space - or rather unused space is not necessarily put to all zero. For instance, a quick format only makes sure that the file system meta information is created, commonly at the start of the partition. The rest is left untouched.

is disk encryption always encrypt data into same location? lets say data from sector 200 will always land after encryption in sector 200? (assuming that we are not adding any HMAC which expands the data).

Depends I guess. Usually you have two situations: encrypting an already existing file system structure and adding information to the file system. If it is encrypted then generally the sectors would probably stay the same for most software, although the physical location may still change (e.g. for an SSD with write leveling). And yes, that can be dangerous.

When writing new data to a "live" file system you'd expect that the data gets encrypted before it is written, so there is no "source sector".

Does AES keep track which sector of disk is encrypting? Or this info is irrelevant for encryption? I think bitlocker in CBC mode adds IV as encrypted sector number - but is it to keep track on sector number or just to randomize the input (instead of sector number they could just add any random number)

The disk encryption uses AES, AES doesn't use disk encryption. AES is a block cipher algorithm and as such instances of AES doesn't know anything about what task it is performing, other than that required to encrypt or decrypt a single block.

Yes, the IV is just used to randomize the input.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.