As far as I know the only disadvantage that XEX has when compared to CTR is that you need a block cipher/permutation while CTR is fine with just a hash function. Meanwhile XEX offers the advantage that it is more misuse-resistant (reuse of the counter/nonce breaks CTR but this is not an issue with XEX) and less malleabile. Considering that, why is XEX almost never used outside of disk encryption?

  • $\begingroup$ Note that CTR needs a pseudo-random function, that is a function that takes a random key and some non-random input and produces some random-looking output. A hash function usually doesn't satisfy this API with only one input... $\endgroup$ – SEJPM Apr 14 '20 at 9:43
  • $\begingroup$ @SEJPM no, but HMAC does, wrapped around a hash function, I would consider that to fit the bill for "implementing CTR with hash functions": crypto.stackexchange.com/questions/29232/… $\endgroup$ – Richie Frame Apr 14 '20 at 9:59
  • 1
    $\begingroup$ Another place that XEX is used is when you might have a noisy channel. Let's say that you have a sensor in a remote location. You'll use XEX because you might lose the comm link on the order of hours. $\endgroup$ – b degnan Apr 14 '20 at 12:33
  • $\begingroup$ @SEJPM That did not stop Salsa20. $\endgroup$ – user79087 Apr 14 '20 at 19:42
  • $\begingroup$ @bdegnan Please elaborate. Why would CTR not be acceptable in this situation? $\endgroup$ – user79087 Apr 14 '20 at 19:42

If CPA-security is sufficient, then CTR is sufficient. If you need authenticated encryption (or CCA), then neither XEX/XTS nor CTR is sufficient and you should be using AES-GCM or something similar. In general, as soon as you want something that is "less malleable" then you consider malleability a threat and you should be using authenticated encryption. If you are worried about nonce misuse resistance, then likewise you should be using such a scheme (SIV or GCM-SIV, etc.).

There is just no good reason to use XEX/XTS, except when you have a severe limitation like in disk encryption that you cannot increase the sector size.

  • $\begingroup$ This does not answer my question as it does not mention any drawback of XEX compared to CTR. As for XEX/CTR not being sufficient, adding a mac-tag is the most trivial thing. In addition as far as I know nobody uses GCM-SIV. $\endgroup$ – user79087 Apr 14 '20 at 19:41
  • 1
    $\begingroup$ It does answer your question. CTR is much simpler and faster and sufficient for CPA. You mentioned malleability, so this is apparently a goal, but XEX/XTS does not solve it. Yes you can add a MAC but why would you not use a much faster and standard scheme. Finally, Google uses GCM-SIV in QUIC, and AWS uses a variant of GCM-SIV for encryption. $\endgroup$ – Yehuda Lindell Apr 16 '20 at 5:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.