My understanding about XEX/XTS mode is limited. But from what I see, it has two good properties:

  1. It is length-preserving so that encryption doesn't cost additional space.

  2. It is deterministic, which is (usually bad but could be) a requirement in some use cases.

Assuming space is a scarce resource, encryption must be deterministic, while authentication is unnecessary, would XEX/XTS mode be a great choice for normal file encryption?

(A file is a byte stream, but we can impose offset-based virtual sectors on the stream and use these sector numbers in XEX/XTS algorithm.)

  • $\begingroup$ XTS / XEX were designed with an additional constraint in mind: Only requiring one block cipher call ($\pm$ on average) per data block. There are better modes that require two block calls, but this has been deemed "too slow" for most disk encryption SW. $\endgroup$ – SEJPM May 13 '20 at 9:13
  • $\begingroup$ @SEJPM Do you mean "wide-block" ones such as CMC and EME? What exactly makes them "better"? $\endgroup$ – Cyker May 13 '20 at 16:34
  • $\begingroup$ yes, the fact that a single bit change randomizes more bytes, yielding better poor man's authentication. $\endgroup$ – SEJPM May 13 '20 at 17:07
  • $\begingroup$ @SEJPM That would make sense. Back to our topic, would there be other issues if we borrow a disk encryption algorithm (either XTS or CMC) for byte stream encryption? $\endgroup$ – Cyker May 13 '20 at 17:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.