As far as I know the only disadvantage that XEX has when compared to CTR is that you need a block cipher/permutation while CTR is fine with just a hash function. Meanwhile XEX offers the advantage that it is more misuse-resistant (reuse of the counter/nonce breaks CTR but this is not an issue with XEX) and less malleabile. Considering that, why is XEX almost never used outside of disk encryption?
8
-
$\begingroup$ Note that CTR needs a pseudo-random function, that is a function that takes a random key and some non-random input and produces some random-looking output. A hash function usually doesn't satisfy this API with only one input... $\endgroup$– SEJPMCommented Apr 14, 2020 at 9:43
-
$\begingroup$ @SEJPM no, but HMAC does, wrapped around a hash function, I would consider that to fit the bill for "implementing CTR with hash functions": crypto.stackexchange.com/questions/29232/… $\endgroup$– Richie FrameCommented Apr 14, 2020 at 9:59
-
1$\begingroup$ Another place that XEX is used is when you might have a noisy channel. Let's say that you have a sensor in a remote location. You'll use XEX because you might lose the comm link on the order of hours. $\endgroup$– b degnanCommented Apr 14, 2020 at 12:33
-
$\begingroup$ @SEJPM That did not stop Salsa20. $\endgroup$– user79087Commented Apr 14, 2020 at 19:42
-
$\begingroup$ @bdegnan Please elaborate. Why would CTR not be acceptable in this situation? $\endgroup$– user79087Commented Apr 14, 2020 at 19:42
|
Show 3 more comments
1 Answer
$\begingroup$
$\endgroup$
2
If CPA-security is sufficient, then CTR is sufficient. If you need authenticated encryption (or CCA), then neither XEX/XTS nor CTR is sufficient and you should be using AES-GCM or something similar. In general, as soon as you want something that is "less malleable" then you consider malleability a threat and you should be using authenticated encryption. If you are worried about nonce misuse resistance, then likewise you should be using such a scheme (SIV or GCM-SIV, etc.).
There is just no good reason to use XEX/XTS, except when you have a severe limitation like in disk encryption that you cannot increase the sector size.
answered Apr 14, 2020 at 8:26
-
$\begingroup$ This does not answer my question as it does not mention any drawback of XEX compared to CTR. As for XEX/CTR not being sufficient, adding a mac-tag is the most trivial thing. In addition as far as I know nobody uses GCM-SIV. $\endgroup$ Commented Apr 14, 2020 at 19:41
-
1$\begingroup$ It does answer your question. CTR is much simpler and faster and sufficient for CPA. You mentioned malleability, so this is apparently a goal, but XEX/XTS does not solve it. Yes you can add a MAC but why would you not use a much faster and standard scheme. Finally, Google uses GCM-SIV in QUIC, and AWS uses a variant of GCM-SIV for encryption. $\endgroup$ Commented Apr 16, 2020 at 5:07