With XTS mode encryption data can be "tampered with" with the caveat that any changes to the data are random and unpredictable to an attacker. Since encryption acts as a pseudo-random function for any secure encryption you end up with a secure scheme:
Note that for each block there is a unique 128-bit block id
according to XTS mode. This ID needs not be random.
XTS mode takes ENC(block XOR block_id) XOR block_id
- If XTS was only
ENC(block XOR block_id)
an attacker can control the value block XOR block_id
used to encrypt. This can be potentially useful if the attacker wants to convert it to ECB mode encryption allowing them to run other attacks; but only works in a chosen-plaintext case. This assumes the attacker knows the block id.
- If XTS was only
ENC(block) XOR block_id
an attacker can XOR the block ID manually from the ciphertext to reveal ECB-mode encryption. This assumes the attacker knows the block id. This works in a ciphertext-only attack.
- If the attacker can perform #2 they can extend that to
ENC(block XOR block_id) XOR block_id
. This yields an attack where they combine attacks #1 and #2.
... Or can they?
If an attacker tries the composite attack they'll be restricted by their knowledge of the block id. But in XTS mode the block id is kept secret by encrypting another key, and using that to create the block id. If the attacker knew the block ids used, they could use the outlined composite attack.
If the scheme was ENC(block) XOR block_id
the attacker could find the block ids used via the same cryptanalysis that breaks ECB mode, if they knew the pattern between block ids; effectively yielding an obfuscated ECB mode encryption in any case there the block ids are predictable (eg. each block id is the previous id + 1).
If the scheme was ENC(block XOR block_id)
the attacker would be unable to recover the block ids, since they would be unable to determine from the ciphertext which ids are likely to be correct.
In the actual XTS mode, since it combines both of those simplified cases the attacker is SOL. Plus, you may have noticed neither of those cases allow an attacker to intelligently modify the plaintext from the ciphertext.
Those attacks can reveal patterns in the information but neither allows (intelligent) data tampering.
- CBC mode allows tampering because each block is XORd with the ciphertext of the previous block (the block id is known simply by looking at the ciphertext).
- The attacker can modify the ciphertext of the previous block to change the data in a specified block.
- The previous block, after tampering, becomes meaningless; but the block the attacker wanted to change is intelligently modified.
- In CTR mode tampering is possible because the plaintext/ciphertext isn't passed through the encryption function, at all; it's simply XORd with a random stream (the random stream is generated by the encryption function).
In a secure block cipher, any change to the ciphertext yields random and meaningless plaintext once passed through the encryption function. Therefore, any attempt at tampering would yield that result.
In short,
XTS mode does allow tampering in a certain sense, but the attacker cannot know or predict what the data will become. They can only say "F**k you, your data is meaningless!"