Should I be worried about XTS tampering when encrypting backups using VeraCrypt?

Question

From Wikipedia:

XTS mode is susceptible to data manipulation and tampering, and applications must employ measures to detect modifications of data if manipulation and tampering is a concern: "...since there are no authentication tags then any ciphertext (original or modified by attacker) will be decrypted as some plaintext and there is no built-in mechanism to detect alterations. The best that can be done is to ensure that any alteration of the ciphertext will completely randomize the plaintext, and rely on the application that uses this transform to include sufficient redundancy in its plaintext to detect and discard such random plaintexts."

I am researching secure ways of backing up data on a regular basis (using deduplication or versioning).

The backup would be stored in low security location (meaning an attacker could have access to the data over long amounts of time and over multiple backup cycles).

Should I be worried about XTS tampering when encrypting backups using VeraCrypt?

Answer 1

With XTS mode encryption data can be "tampered with" with the caveat that any changes to the data are random and unpredictable to an attacker. Since encryption acts as a pseudo-random function for any secure encryption you end up with a secure scheme:

Note that for each block there is a unique 128-bit block id according to XTS mode. This ID needs not be random.

XTS mode takes ENC(block XOR block_id) XOR block_id

1. If XTS was only ENC(block XOR block_id) an attacker can control the value block XOR block_id used to encrypt. This can be potentially useful if the attacker wants to convert it to ECB mode encryption allowing them to run other attacks; but only works in a chosen-plaintext case. This assumes the attacker knows the block id.
2. If XTS was only ENC(block) XOR block_id an attacker can XOR the block ID manually from the ciphertext to reveal ECB-mode encryption. This assumes the attacker knows the block id. This works in a ciphertext-only attack.
3. If the attacker can perform #2 they can extend that to ENC(block XOR block_id) XOR block_id. This yields an attack where they combine attacks #1 and #2.

... Or can they?

If an attacker tries the composite attack they'll be restricted by their knowledge of the block id. But in XTS mode the block id is kept secret by encrypting another key, and using that to create the block id. If the attacker knew the block ids used, they could use the outlined composite attack.

• If the scheme was ENC(block) XOR block_id the attacker could find the block ids used via the same cryptanalysis that breaks ECB mode, if they knew the pattern between block ids; effectively yielding an obfuscated ECB mode encryption in any case there the block ids are predictable (eg. each block id is the previous id + 1).

• If the scheme was ENC(block XOR block_id) the attacker would be unable to recover the block ids, since they would be unable to determine from the ciphertext which ids are likely to be correct.

• In the actual XTS mode, since it combines both of those simplified cases the attacker is SOL. Plus, you may have noticed neither of those cases allow an attacker to intelligently modify the plaintext from the ciphertext.

Those attacks can reveal patterns in the information but neither allows (intelligent) data tampering.

• CBC mode allows tampering because each block is XORd with the ciphertext of the previous block (the block id is known simply by looking at the ciphertext).
  • The attacker can modify the ciphertext of the previous block to change the data in a specified block.
  • The previous block, after tampering, becomes meaningless; but the block the attacker wanted to change is intelligently modified.
• In CTR mode tampering is possible because the plaintext/ciphertext isn't passed through the encryption function, at all; it's simply XORd with a random stream (the random stream is generated by the encryption function).

In a secure block cipher, any change to the ciphertext yields random and meaningless plaintext once passed through the encryption function. Therefore, any attempt at tampering would yield that result.

In short,

XTS mode does allow tampering in a certain sense, but the attacker cannot know or predict what the data will become. They can only say "F**k you, your data is meaningless!"