Questions tagged [disk-encryption]

Disk encryption protects information by encrypting every byte that is written to a HD or virtual disk volume.

Filter by
Sorted by
Tagged with
3 votes
1 answer
358 views

Using YubiKey to store a PIN-protected secret for disk encryption

I want to store a secret on YubiKey and use it for disk encryption. It's crucial that it be PIN protected. There are a limited number of PIN tries, and after three attempts the YubiKey would be ...
0 votes
1 answer
76 views

Is it possible for XTS to use two different key sizes?

As an example could be XTS with a 512-bit key that treats the key as one 128-bit key and one 348-bit key. As to why I'm asking it's because XTS runs on one large key that it treats like two keys. ...
4 votes
0 answers
800 views

XTS-AES-128 and Grover's algorithm

AES-128 is considered weak against quantum computers because Grover's algorithm effectively halves its key length to unacceptable 64 bits. XTS-AES-128 as described in IEEE 1619-2007 doubles key ...
0 votes
2 answers
87 views

May specifying the position of swapfile help defeat LUKS encryption?

I need to enable hybernation to the LUKS-encrypted drive. My /boot partition is unencrypted hence it stores all kernel images as well as kernel parameters in unencrypted form. For hybernation to work ...
5 votes
0 answers
786 views

For TCG-Opal drives, which password is used to derive KEK?

SEDs use a user password (PIN) to generate KEK by a KDF algorithm. The KEK is then used to encrypt the MEK (where MEK is internally generated in the drive). But TCG-Opal drives have 9 locking-ranges ...
1 vote
0 answers
26 views

Tag Management Problem in Authenticated Disk Encryption

1) For authenticated disk encryption, there are extra data such as IV or tag that need to be stored for all the alternative mods that are placed in Table 1. For these data, it will be necessary to use ...
1 vote
1 answer
101 views

Disk encryption and advanced format

As far as I understand, the biggest problem of requesting authentication in disk encryption is that the plaintext and ciphertext are not having the same size -because of tag-. The XTS mode is already ...
1 vote
0 answers
59 views

Authenticated Encryption with Length Expansion for Storage Devices

Recently, I've been working on disk encryption. I started with the AES-XTS mode which is the standard for this purpose and tried to understand the concept of disk encryption in general. I know that ...
7 votes
2 answers
611 views

Fast cipher without needing hardware support (like ChaCha20) for disk encryption

On my old laptop, ChaCha20 is quite a bit faster than AES as there is no hardware acceleration for AES. But for disk encryption AES based schemes seem to be the only option, as a stream cipher like ...
5 votes
1 answer
4k views

How does LUKS encrypt the master key?

I'm studying how LUKS/dm-crypt works, and I've learnt that: the user supplies a (possibly weak) passphrase the passphrase is turned into a Key Encryption Key (KEK) by a Key Derivative Function (KFD), ...
2 votes
0 answers
317 views

Why is using ChaCha20 for disk encryption insecure?

https://en.wikipedia.org/wiki/Disk_encryption_theory Why do we use XTS over CTR for disk encryption? If we used ChaCha20 (without authentication) by simply encrypting each disk sector with the same ...
4 votes
1 answer
156 views

What would be the maximum acceptable block size for disk enryption?

AES-256 in XTS mode has 32x16 (512) bytes of blocksize but there are some other wide-block modes of operation such as WCFB which accepts any block size. My question is: What is the maximum acceptable ...
1 vote
1 answer
637 views

Are brute-force attacks made more difficult by removing the LUKS header?

If the LUKS header is removed from the LUKS partition, will this make the brute-force attack much more difficult? Can software tell which type of partition is it?
10 votes
2 answers
11k views

LUKS multiple key slots - what's the intuition?

LUKS volumes have the ability to allow multiple independently usable passwords, as explained here: [https://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions] The intuition behind basic ...
3 votes
1 answer
1k views

Security of McCallum-Relyea exchange

I recently learned of the McCallum-Relyea exchange which allows for a method of key escrow without actually transmitting the key. It was developed at RedHat and is used by the tang and clevis ...
5 votes
1 answer
4k views

what are the security benefits of LUKS?

Aremed with only basic crypto knowledge, I'm trying to understand the security benefits of LUKS over plain-mode dm-crypt. Hopefully this is a good place to ask. Given the LUKS header contains ...
1 vote
2 answers
98 views

How can an adversary request decryption of an unused sector?

The Wikipedia article on Disk Encryption Theory mentions this a powerful adversary can modify an unused sector on the disk and then request its decryption. I understand that an adversary is ...
1 vote
0 answers
227 views

Difference between LRW and XEX modes

LRW and XEX modes of operation look similar. They are both tweakable narrow-block encryption with XORs before and after each single-block cipher. I didn't really get the point where they differ or ...
2 votes
1 answer
134 views

When using CBC-ESSIV for disk encryption, why does the generation of IV require a hash then encryption instead of only one hash?

The CBC-ESSIV algorithm specifies how to calculate the IV to use for a given key (K) and sector number (S) as the following: $$\text{IV} = \operatorname{Enc}(\operatorname{Hash}(K) , S)$$ https://en....
2 votes
1 answer
353 views

Does Encryption add difficulties to File Recovery?

Seems Yes. People always tell us, it is very hard (or almost impossible) to recover an encrypted hard disk. But after a second thought. I think this is not true. Given that we know the KEY, and the ...
4 votes
1 answer
396 views

Regarding XEX mode

Wikipedia claims that given an unkeyed permutation $p$ (presumably of the same size as the key) this is safe: $p(m \oplus k) \oplus k$ Why isn't this construction used instead of XEX? Surely unkeyed ...
1 vote
2 answers
238 views

Decently safe amount of AES key derivation?

I am encrypting my computer using Veracrypt. The default 500,000 derivations is quite slow, what would a "safe" balance be between security and speed? My password is more than 20 characters.
2 votes
0 answers
82 views

Cascaded XTS vs XTS with cascaded block ciphers

The popular VeraCrypt encryption utility, as well as its precursor TrueCrypt, has the option to cascade multiple ciphers on top of each other, such as AES-Twofish-Serpent. It works by cascading three ...
3 votes
0 answers
230 views

Can XTS + checksum be used for authenticated encryption?

Is it possible to use XTS + a checksum for authenticated encryption? Specifically, it seems like a good $n$ bit checksum applied before encryption should ensure that any change to the ciphertext will ...
1 vote
1 answer
653 views

confusion about LUKS encryption

from Can I clone a LUKS container? You can, but it breaks security, because the cloned container has the same header and hence the same master key. You cannot change the master key on a LUKS ...
3 votes
2 answers
3k views

LUKS: decrypting with master-key rather than with passphrase

It's my understanding that LUKS encrypts data by using a randomly-generated master-key, which is then itself stored encrypted by my passphrase. When I want to access the data, I use my passphrase to ...
2 votes
1 answer
1k views

How to determine the fastest OpenSSL cryptographic algorithm

This question does have to do with cryptography, but not necessarily with encrypting meaningful data. This is my first post here, so if I'm going about this question incorrectly please let me know. ...
0 votes
0 answers
191 views

Combining stream cipher with block cipher for disk encryption

You take something like chacha20 and use the disk block # to seek it, xor it with the data block and then encrypt it with a block cipher in ECB mode. Would this be secure? Edit: To avoid getting ...
2 votes
1 answer
477 views

Can wiping a disk writing zeros on an encrypted device be a weak point?

Can cryptsetup suggestion of wiping a disk before encryption with zeros written to an encryted device as described in question 2.19 as the recommended method on the CryptsetupFAQ (the part that starts ...
1 vote
0 answers
257 views

Why does the Content Scrambling System have two different length LFSRs

CSS uses two LFSRs of length 17 and 25. If we have two periodic functions $f(t)$ and $g(t)$ and consider the function $h(t) = (f(t), g(t))$, then $h$ will have period $pq/\gcd(p, q)$ where $p$ and $q$...
6 votes
1 answer
766 views

How can XTS be used to detect the presence of TrueCrypt hidden volumes?

According to a thread on the VeraCrypt discussion forum, and a single-post followup, it is possible to detect the presence of a hidden volume in certain conditions due to a flaw in the cryptography or ...
1 vote
2 answers
809 views

Has anyone seen a stream cipher being used for FDE

So I am a newbie to this. Has anyone experimented implementing a stream cipher for full disk encryption? EDIT With the caveats that come with using a stream cipher over a block cipher of course! I ...
1 vote
0 answers
138 views

What are the malleability properties of block device encryption with multiple modes of operation?

When encrypting a block device with a given symmetric cipher with a 128-bit block size in CBC mode, every second plaintext block in a sector can be changed to contain arbitrary data, with the blocks ...
4 votes
2 answers
94 views

Does observing amount of changes in encrypted disk ciphertext have a well-known attack name?

Let us assume that I have two partitions on my hard disk, and unencrypted one and an encrypted one. Let us also assume that I shut down the computer when sleeping or away, and an attacker has physical ...
29 votes
6 answers
5k views

Why not authenticate full-disk encryption?

Common FDE software (TrueCrypt, BitLocker, dm-crypt) doesn't authenticate ciphertext stored on the disk. The commonly cited reason is "it would take too much space", reasoning that you would need an ...
1 vote
1 answer
233 views

Does passphrase length impact read-write speed?

I'm using Diskcryptor to encrypt a 2TB external USB HD and the process is taking over 2 days. I chose a 100-character strong encryption key passphrase (because, why not?) and am now wondering if the ...
6 votes
1 answer
727 views

Ephemeral Encryption Keys

My understanding is, ignoring implementation details, iOS disk encryption works like this: On boot (and/or every time you unlock your phone) an ephemeral session key is created that can decrypt ...
1 vote
1 answer
238 views

Are Iphones' content encrypted?

Recently I heard that the content of an Iphone is stored in encrypted form meaning that if I were to take apart the Iphone and managed to extract the memory and read it, I wouldn't be able to get any ...
7 votes
2 answers
5k views

Should I use XTS or GCM to encrypt my hard drives?

I want to start encrypting all of my hard drives, but I don't know whether to choose XTS or GCM mode. Why is it that XTS is recommended (since the most websites I visit use GCM in their HTTPS ...
1 vote
1 answer
850 views

Disk encryption using AES-CBC: is reliance on previous block data a downside?

I have seen drives that boast that they use AES with CBC mode, which doesn't really make sense in my opinion, sure it's more secure than ECB (but actually, leaving security aside, ECB is better suited ...
25 votes
2 answers
9k views

Why do we use XTS over CTR for disk encryption?

I'm taking Prof. Boneh's crypto class from Coursera, and am unsure on the requirement for XTS mode for disk encryption. It seems that CTR mode would do exactly what XTS can do, but is simpler to ...
3 votes
0 answers
1k views

High-level overview of system architecture of LUKS/cryptsetup (how it works vs. how to setup) [closed]

I've been searching (unsuccessfully) online for a high-level overview of how LUKS/cryptsetup disk encryption works. I am reading through the cryptsetup source code to try to understand what is going ...
9 votes
1 answer
3k views

Effect of ESSIV when used with XTS

I looked everywhere on the web and I did find a lot of information about full disk encryption, but nothing really answered my question. When formatting a partition to use LUKS, the two most common ...
3 votes
0 answers
223 views

How does FileVault2 Recovery actually work?

I'm a crypto-enthusiast but no expert at all, that'll explain why i didn't understand. Also please consider english isn't my native language :) I am about to enable FileVault2 FDE on the new macbook ...
6 votes
2 answers
662 views

Encrypt-Mix-Encrypt: Full Diffusion?

I've read "A Parallelizable Enciphering Mode" by Halevi and Rogaway about the encrypt-mix-encrypt mode for ciphers and was asking myself if this mode provides "full" diffusion. So if an attacker ...
3 votes
1 answer
476 views

Does XTS provide random write access?

I'm trying to find a sufficient encryption mode that supports random read and write access. It seems like XTS is a perfect fit, since in my use case authentication and integrity insurance are handled ...
4 votes
1 answer
846 views

Modes of encryption for hard drives?

What are the currently recommended modes of encryption for large disks? Basic requirements would seem to be that you can update an encrypted sector independently of others, which rules out most ...
7 votes
2 answers
2k views

Is it possible to tweak AES-GCM so that it is satisfactory for whole-disk encryption (like XTS mode)?

Is it possible to leverage a preexisting implementation of AES-GCM to provide the key security benefits essential for full-disk encryption (similar to AES-XTS)? GCM is a popular encryption mode ...
1 vote
0 answers
762 views

FileVault AES-XTS decryption with cipher text that's missing a part

My mac was recently upgraded to OS X Yosemite and FileVault2 full disk encryption was turned on. Encryption finished, but things went horribly wrong and key parts of the disk are filled with all 0s (...
2 votes
2 answers
589 views

How do disk encryption programs solve the "IV problem"?

I was reading a paper on the "elephant diffuser" used in BitLocker and it got me wondering how other systems (e.g. TrueCrypt before it shutdown) solved the problem the elephant diffuser was meant to ...