Questions tagged [disk-encryption]
Disk encryption protects information by encrypting every byte that is written to a HD or virtual disk volume.
58 questions
0
votes
1
answer
100
views
Is it possible for XTS to use two different key sizes?
As an example could be XTS with a 512-bit key that treats the key as one 128-bit key and one 348-bit key.
As to why I'm asking it's because XTS runs on one large key that it treats like two keys. ...
0
votes
2
answers
96
views
May specifying the position of swapfile help defeat LUKS encryption?
I need to enable hybernation to the LUKS-encrypted drive. My /boot partition is unencrypted hence it stores all kernel images as well as kernel parameters in unencrypted form. For hybernation to work ...
- 1
1
vote
0
answers
26
views
Tag Management Problem in Authenticated Disk Encryption
1) For authenticated disk encryption, there are extra data such as IV or tag that need to be stored for all the alternative mods that are placed in Table 1. For these data, it will be necessary to use ...
- 715
1
vote
1
answer
111
views
Disk encryption and advanced format
As far as I understand, the biggest problem of requesting authentication in disk encryption is that the plaintext and ciphertext are not having the same size -because of tag-. The XTS mode is already ...
- 715
1
vote
0
answers
64
views
Authenticated Encryption with Length Expansion for Storage Devices
Recently, I've been working on disk encryption. I started with the AES-XTS mode which is the standard for this purpose and tried to understand the concept of disk encryption in general.
I know that ...
- 715
8
votes
2
answers
1k
views
Fast cipher without needing hardware support (like ChaCha20) for disk encryption
On my old laptop, ChaCha20 is quite a bit faster than AES as there is no hardware acceleration for AES. But for disk encryption AES based schemes seem to be the only option, as a stream cipher like ...
- 243
2
votes
0
answers
393
views
Why is using ChaCha20 for disk encryption insecure?
https://en.wikipedia.org/wiki/Disk_encryption_theory
Why do we use XTS over CTR for disk encryption?
If we used ChaCha20 (without authentication) by simply encrypting each disk sector with the same ...
- 21
4
votes
1
answer
193
views
What would be the maximum acceptable block size for disk enryption?
AES-256 in XTS mode has 32x16 (512) bytes of blocksize but there are some other wide-block modes of operation such as WCFB which accepts any block size.
My question is:
What is the maximum acceptable ...
- 887
1
vote
1
answer
737
views
Are brute-force attacks made more difficult by removing the LUKS header?
If the LUKS header is removed from the LUKS partition, will this make the brute-force attack much more difficult? Can software tell which type of partition is it?
- 11
5
votes
2
answers
1k
views
Security of McCallum-Relyea exchange
I recently learned of the McCallum-Relyea exchange which allows for a method of key escrow without actually transmitting the key.
It was developed at RedHat and is used by the tang and clevis ...
- 298
5
votes
1
answer
4k
views
How does LUKS encrypt the master key?
I'm studying how LUKS/dm-crypt works, and I've learnt that:
the user supplies a (possibly weak) passphrase
the passphrase is turned into a Key Encryption Key (KEK) by a Key Derivative Function (KFD), ...
- 51
5
votes
0
answers
894
views
For TCG-Opal drives, which password is used to derive KEK?
SEDs use a user password (PIN) to generate KEK by a KDF algorithm. The KEK is then used to encrypt the MEK (where MEK is internally generated in the drive). But TCG-Opal drives have 9 locking-ranges ...
- 75
1
vote
2
answers
102
views
How can an adversary request decryption of an unused sector?
The Wikipedia article on Disk Encryption Theory mentions this
a powerful adversary can modify an unused sector on the disk and then request its decryption.
I understand that an adversary is ...
user80567
1
vote
0
answers
279
views
Difference between LRW and XEX modes
LRW and XEX modes of operation look similar. They are both tweakable narrow-block encryption with XORs before and after each single-block cipher.
I didn't really get the point where they differ or ...
- 739
2
votes
1
answer
165
views
When using CBC-ESSIV for disk encryption, why does the generation of IV require a hash then encryption instead of only one hash?
The CBC-ESSIV algorithm specifies how to calculate the IV to use for a given key (K) and sector number (S) as the following:
$$\text{IV} = \operatorname{Enc}(\operatorname{Hash}(K) , S)$$
https://en....
- 339
2
votes
1
answer
370
views
Does Encryption add difficulties to File Recovery?
Seems Yes. People always tell us, it is very hard (or almost impossible) to recover an encrypted hard disk.
But after a second thought. I think this is not true.
Given that we know the KEY, and the ...
- 121
4
votes
1
answer
484
views
Regarding XEX mode
Wikipedia claims that given an unkeyed permutation $p$ (presumably of the same size as the key) this is safe: $p(m \oplus k) \oplus k$
Why isn't this construction used instead of XEX? Surely unkeyed ...
- 143
1
vote
2
answers
302
views
Decently safe amount of AES key derivation?
I am encrypting my computer using Veracrypt. The default 500,000 derivations is quite slow, what would a "safe" balance be between security and speed? My password is more than 20 characters.
- 11
2
votes
0
answers
85
views
Cascaded XTS vs XTS with cascaded block ciphers
The popular VeraCrypt encryption utility, as well as its precursor TrueCrypt, has the option to cascade multiple ciphers on top of each other, such as AES-Twofish-Serpent. It works by cascading three ...
- 15.5k
1
vote
1
answer
748
views
confusion about LUKS encryption
from Can I clone a LUKS container?
You can, but it breaks security, because the cloned container has the
same header and hence the same master key. You cannot change the
master key on a LUKS ...
- 173
2
votes
1
answer
2k
views
How to determine the fastest OpenSSL cryptographic algorithm
This question does have to do with cryptography, but not necessarily with encrypting meaningful data. This is my first post here, so if I'm going about this question incorrectly please let me know.
...
- 21
3
votes
2
answers
4k
views
LUKS: decrypting with master-key rather than with passphrase
It's my understanding that LUKS encrypts data by using a randomly-generated master-key, which is then itself stored encrypted by my passphrase. When I want to access the data, I use my passphrase to ...
- 31
3
votes
1
answer
420
views
Using YubiKey to store a PIN-protected secret for disk encryption
I want to store a secret on YubiKey and use it for disk encryption. It's crucial that it be PIN protected. There are a limited number of PIN tries, and after three attempts the YubiKey would be ...
- 610
0
votes
0
answers
197
views
Combining stream cipher with block cipher for disk encryption
You take something like chacha20 and use the disk block # to seek it, xor it with the data block and then encrypt it with a block cipher in ECB mode.
Would this be secure?
Edit:
To avoid getting ...
user64218
2
votes
1
answer
565
views
Can wiping a disk writing zeros on an encrypted device be a weak point?
Can cryptsetup suggestion of wiping a disk before encryption with zeros written to an encryted device as described in question 2.19 as the recommended method on the CryptsetupFAQ (the part that starts ...
- 23
1
vote
0
answers
260
views
Why does the Content Scrambling System have two different length LFSRs
CSS uses two LFSRs of length 17 and 25.
If we have two periodic functions $f(t)$ and $g(t)$ and consider the function $h(t) = (f(t), g(t))$, then $h$ will have period $pq/\gcd(p, q)$
where $p$ and $q$...
- 71
6
votes
1
answer
804
views
How can XTS be used to detect the presence of TrueCrypt hidden volumes?
According to a thread on the VeraCrypt discussion forum, and a single-post followup, it is possible to detect the presence of a hidden volume in certain conditions due to a flaw in the cryptography or ...
- 15.5k
2
votes
2
answers
848
views
Has anyone seen a stream cipher being used for FDE
So I am a newbie to this. Has anyone experimented implementing a stream cipher for full disk encryption?
EDIT
With the caveats that come with using a stream cipher over a block cipher of course! I ...
- 21
4
votes
0
answers
869
views
XTS-AES-128 and Grover's algorithm
AES-128 is considered weak against quantum computers because Grover's algorithm effectively halves its key length to unacceptable 64 bits.
XTS-AES-128 as described in IEEE 1619-2007 doubles key ...
- 141
1
vote
0
answers
140
views
What are the malleability properties of block device encryption with multiple modes of operation?
When encrypting a block device with a given symmetric cipher with a 128-bit block size in CBC mode, every second plaintext block in a sector can be changed to contain arbitrary data, with the blocks ...
- 11
4
votes
2
answers
99
views
Does observing amount of changes in encrypted disk ciphertext have a well-known attack name?
Let us assume that I have two partitions on my hard disk, and unencrypted one and an encrypted one. Let us also assume that I shut down the computer when sleeping or away, and an attacker has physical ...
- 1,623
29
votes
6
answers
5k
views
Why not authenticate full-disk encryption?
Common FDE software (TrueCrypt, BitLocker, dm-crypt) doesn't authenticate ciphertext stored on the disk. The commonly cited reason is "it would take too much space", reasoning that you would need an ...
- 393
1
vote
1
answer
237
views
Does passphrase length impact read-write speed?
I'm using Diskcryptor to encrypt a 2TB external USB HD and the process is taking over 2 days. I chose a 100-character strong encryption key passphrase (because, why not?) and am now wondering if the ...
- 113
6
votes
1
answer
772
views
Ephemeral Encryption Keys
My understanding is, ignoring implementation details, iOS disk encryption works like this: On boot (and/or every time you unlock your phone) an ephemeral session key is created that can decrypt ...
- 163
1
vote
1
answer
284
views
Are Iphones' content encrypted?
Recently I heard that the content of an Iphone is stored in encrypted form meaning that if I were to take apart the Iphone and managed to extract the memory and read it, I wouldn't be able to get any ...
- 19
7
votes
2
answers
5k
views
Should I use XTS or GCM to encrypt my hard drives?
I want to start encrypting all of my hard drives, but I don't know whether to choose XTS or GCM mode. Why is it that XTS is recommended (since the most websites I visit use GCM in their HTTPS ...
- 581
2
votes
1
answer
889
views
Disk encryption using AES-CBC: is reliance on previous block data a downside?
I have seen drives that boast that they use AES with CBC mode, which doesn't really make sense in my opinion, sure it's more secure than ECB (but actually, leaving security aside, ECB is better suited ...
- 340
3
votes
0
answers
239
views
Can XTS + checksum be used for authenticated encryption?
Is it possible to use XTS + a checksum for authenticated encryption? Specifically, it seems like a good $n$ bit checksum applied before encryption should ensure that any change to the ciphertext will ...
- 4,813
3
votes
0
answers
1k
views
High-level overview of system architecture of LUKS/cryptsetup (how it works vs. how to setup) [closed]
I've been searching (unsuccessfully) online for a high-level overview of how LUKS/cryptsetup disk encryption works. I am reading through the cryptsetup source code to try to understand what is going ...
- 131
9
votes
1
answer
3k
views
Effect of ESSIV when used with XTS
I looked everywhere on the web and I did find a lot of information about full disk encryption, but nothing really answered my question.
When formatting a partition to use LUKS, the two most common ...
- 193
3
votes
0
answers
232
views
How does FileVault2 Recovery actually work?
I'm a crypto-enthusiast but no expert at all, that'll explain why i didn't understand. Also please consider english isn't my native language :)
I am about to enable FileVault2 FDE on the new macbook ...
- 31
3
votes
1
answer
523
views
Does XTS provide random write access?
I'm trying to find a sufficient encryption mode that supports random read and write access. It seems like XTS is a perfect fit, since in my use case authentication and integrity insurance are handled ...
- 33
6
votes
2
answers
712
views
Encrypt-Mix-Encrypt: Full Diffusion?
I've read "A Parallelizable Enciphering Mode" by Halevi and Rogaway about the encrypt-mix-encrypt mode for ciphers and was asking myself if this mode provides "full" diffusion.
So if an attacker ...
- 46.4k
1
vote
0
answers
784
views
FileVault AES-XTS decryption with cipher text that's missing a part
My mac was recently upgraded to OS X Yosemite and FileVault2 full disk encryption was turned on. Encryption finished, but things went horribly wrong and key parts of the disk are filled with all 0s (...
- 111
10
votes
2
answers
12k
views
LUKS multiple key slots - what's the intuition?
LUKS volumes have the ability to allow multiple independently usable passwords, as explained here:
[https://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions]
The intuition behind basic ...
- 203
4
votes
1
answer
861
views
Modes of encryption for hard drives?
What are the currently recommended modes of encryption for large disks? Basic requirements would seem to be that you can update an encrypted sector independently of others, which rules out most ...
- 375
5
votes
1
answer
5k
views
what are the security benefits of LUKS?
Aremed with only basic crypto knowledge, I'm trying to understand the security benefits of LUKS over plain-mode dm-crypt. Hopefully this is a good place to ask.
Given the LUKS header contains ...
- 195
2
votes
2
answers
608
views
How do disk encryption programs solve the "IV problem"?
I was reading a paper on the "elephant diffuser" used in BitLocker and it got me wondering how other systems (e.g. TrueCrypt before it shutdown) solved the problem the elephant diffuser was meant to ...
- 263
3
votes
1
answer
451
views
Galois field step in XEX mode
I'm reading through the XEX mode spec, and I want to make sure I've understood the $\alpha^j$ step correctly:
$X = E_K(I) \oplus \alpha^j$
$C = E_K(M \oplus X) \oplus X$
where:
$M$ is the ...
- 3,567
5
votes
1
answer
7k
views
Why is Serpent faster than AES in this benchmark?
I have a laptop without the AES-NI CPU instructions but with SSE4.1.
I'm using Linux and tried the (in-memory) cryptsetup benchmark to get the rough tendency which returned:
...
user12593