0
$\begingroup$

My understanding about XEX/XTS mode is limited. But from what I see, it has two good properties:

  1. It is length-preserving so that encryption doesn't cost additional space.

  2. It is deterministic, which is (usually bad but could be) a requirement in some use cases.

Assuming space is a scarce resource, encryption must be deterministic, while authentication is unnecessary, would XEX/XTS mode be a great choice for normal file encryption?

(A file is a byte stream, but we can impose offset-based virtual sectors on the stream and use these sector numbers in XEX/XTS algorithm.)

Improve this question
$\endgroup$
4
  • $\begingroup$ XTS / XEX were designed with an additional constraint in mind: Only requiring one block cipher call ($\pm$ on average) per data block. There are better modes that require two block calls, but this has been deemed "too slow" for most disk encryption SW. $\endgroup$
    – SEJPM
    May 13, 2020 at 9:13
  • $\begingroup$ @SEJPM Do you mean "wide-block" ones such as CMC and EME? What exactly makes them "better"? $\endgroup$
    – Cyker
    May 13, 2020 at 16:34
  • $\begingroup$ yes, the fact that a single bit change randomizes more bytes, yielding better poor man's authentication. $\endgroup$
    – SEJPM
    May 13, 2020 at 17:07
  • $\begingroup$ @SEJPM That would make sense. Back to our topic, would there be other issues if we borrow a disk encryption algorithm (either XTS or CMC) for byte stream encryption? $\endgroup$
    – Cyker
    May 13, 2020 at 17:41

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.