Questions tagged [xts]
XTS is a block cipher mode of operation, which is most commonly used when random accessible data (like a hard disk or RAM) is to be encoded.
47
questions
0
votes
0
answers
45
views
What is the security of XTS block cipher mode of operation if the key is much larger than the block size?
I made two Linux kernel modules of Hasty Pudding Cipher with key size of 16896-bits (16384-bits key + 512-bits tweak also called "spice), one has 512-bits of block size, the other 128-bits.
I ...
- 393
0
votes
1
answer
93
views
Is it possible for XTS to use two different key sizes?
As an example could be XTS with a 512-bit key that treats the key as one 128-bit key and one 348-bit key.
As to why I'm asking it's because XTS runs on one large key that it treats like two keys. ...
0
votes
0
answers
66
views
Required Block Size for XTS Using MSFT CNG
I am struggling with using Microsoft's BCrypt library in AES-XTS mode.
I've confirmed that the Cipher Block Size is 16 bytes (by getting the BCRYPT_BLOCK_LENGTH property). I'm setting the Data Unit ...
- 1
1
vote
1
answer
108
views
Disk encryption and advanced format
As far as I understand, the biggest problem of requesting authentication in disk encryption is that the plaintext and ciphertext are not having the same size -because of tag-. The XTS mode is already ...
- 640
1
vote
0
answers
62
views
Authenticated Encryption with Length Expansion for Storage Devices
Recently, I've been working on disk encryption. I started with the AES-XTS mode which is the standard for this purpose and tried to understand the concept of disk encryption in general.
I know that ...
- 640
2
votes
0
answers
366
views
Why is using ChaCha20 for disk encryption insecure?
https://en.wikipedia.org/wiki/Disk_encryption_theory
Why do we use XTS over CTR for disk encryption?
If we used ChaCha20 (without authentication) by simply encrypting each disk sector with the same ...
- 21
1
vote
1
answer
199
views
Is multiple encryption with XTS mode susceptible to Meet-in-the-middle attacks?
Let's suppose I encrypt something with AES-256 in XTS mode two times (there will be 4 four keys, 2 for each encryption operation), wanting to achive 512-bits of security.
Will this scheme be ...
- 887
1
vote
0
answers
135
views
Is it OK to use a doubled key for XTS-AES?
https://en.wikipedia.org/wiki/Disk_encryption_theory#Xor%E2%80%93encrypt%E2%80%93xor_(XEX) reads:
The standard supports using a different key for the IV encryption than
for the block encryption; this ...
- 958
1
vote
0
answers
67
views
Can XEX or XTS modes be used with only one tweak? (part 2)
This question is similar to Can XEX or XTS modes be used with only one tweak? except I am interested to know if one can instead use
$X = E_{k}(0) \otimes \alpha^j \\
C = E_{k}(P \oplus X) \oplus X$
in ...
2
votes
1
answer
3k
views
Is XTS always better than GCM?
XTS is suitable for disk encryption while GCM doesn't.
Both require the same number of block encryption calls.
Both are parallel in encryption and decryption.
XTS is actually even faster in openssl ...
- 133
0
votes
1
answer
337
views
Should I be worried about XTS tampering when encrypting backups using VeraCrypt?
From Wikipedia:
XTS mode is susceptible to data manipulation and tampering, and applications must employ measures to detect modifications of data if manipulation and tampering is a concern: "......
- 199
1
vote
1
answer
430
views
EAX vs CTR vs XTS + cascade ciphers in disk encryption hell
Often when I stumble across something interesting, I lose myself in the most overkill ways of implementing it. Today it was full disk encryption: I'm about to move to QubesOS, and I want to secure my ...
- 113
0
votes
0
answers
168
views
Is XEX/XTS good for deterministic file encryption?
My understanding about XEX/XTS mode is limited. But from what I see, it has two good properties:
It is length-preserving so that encryption doesn't cost additional space.
It is deterministic, which ...
- 739
2
votes
0
answers
955
views
AES-XTS Integrity protection
AES-XTS does not guarantee data integrity, like AES-GCM for instance. So, in order to support data integrity it is necessary to add some MAC functionality to it. However, adding an independent MAC, ...
- 1,106
1
vote
1
answer
184
views
How reassuring is CRC-then-XTS as authenticated encryption?
It is known that the "xz" compression format embeds a checksum in the compressed file to verify integrity during decompression or standalone testing. The algorithm of the checksum can be one of: CRC32,...
- 9,672
1
vote
1
answer
288
views
IEEE P1619/XTS, inconsistent reference implementation and test vectors [closed]
I'm testing IEEE's P1619, which is XTS mode. IEEE documents from 2007 provided both test vectors and a reference implementation. Documents from 2008 only provided the reference implementation. Here is ...
user10496
4
votes
1
answer
2k
views
XTS or XEX mode?
Modern hardware and software disk encryption uses AES mode of operation. But XTS was designed to "pad" the last block when the disk sector was not divisible by block size.
However all typical disk ...
- 135
4
votes
1
answer
633
views
Is AES in XTS mode insecure for data stream encryption?
Can anybody explain to me why AES in XTS mode is supposedly insecure for data stream encryption? I have been unable to find a clear explanation for this.
- 474
2
votes
0
answers
84
views
Cascaded XTS vs XTS with cascaded block ciphers
The popular VeraCrypt encryption utility, as well as its precursor TrueCrypt, has the option to cascade multiple ciphers on top of each other, such as AES-Twofish-Serpent. It works by cascading three ...
- 15.4k
0
votes
1
answer
776
views
XTS mode of operation and authentication
I'm wondering if XTS is used (Random Access is needed) what the best solution for authentication is. If I wouldn't need random access, I would take AES-GCM or AES-CBC-HMAC but random access is a must.
...
- 33
5
votes
1
answer
2k
views
AES-XTS vs AES-CTR for Write Once Storage
I have a disk on which each sector can only be written once (like a journal, only appending is possible). Unused sectors are reported as being filled with zeroes, while used sectors should not be ...
- 151
3
votes
1
answer
1k
views
XTS mode with the tweak key as the sole secret
The keyspace of XTS is $2^{512}$ due to its use of two distinct keys, and the most effective attack (a meet-in-the-middle attack) brings this down to $2^{384}$. This implies that knowledge of either ...
- 15.4k
3
votes
1
answer
381
views
Is XTS-AES a NIST-approved nonce-misuse-resistant AES mode?
If I use XTS-AES and treat the tweak as a nonce/IV would the result be considered nonce-misuse-resistant?
I'm thinking of something like the following AEAD-like scheme:
...
- 326
7
votes
1
answer
2k
views
Is it problematic to use PBKDF2-HMAC-SHA256 to derive a 512-bit XTS key?
PBKDF2 should only be used to generate a larger output than the hash function it uses if the output is used in such a way that it has a flat keyspace. As far as I am aware, XTS does not have a flat ...
- 15.4k
2
votes
0
answers
335
views
An XTS penguin?
I stumbled across a VPN website when looking up information about XTS, and came across their own explanation of different block modes (basically the ECB penguin, but with their company logo instead). ...
- 15.4k
1
vote
0
answers
138
views
Tree structure with XTS and HMAC: MAC in parent
Situation:
A file format contains a tree-like data structure; parent nodes can find children and child nodes can also find their (single) parent. To protect confidentiality, the nodes in the file are ...
- 11
6
votes
1
answer
796
views
How can XTS be used to detect the presence of TrueCrypt hidden volumes?
According to a thread on the VeraCrypt discussion forum, and a single-post followup, it is possible to detect the presence of a hidden volume in certain conditions due to a flaw in the cryptography or ...
- 15.4k
2
votes
1
answer
388
views
XEX mode - how to perturb the tweak
The first part of the classical description of XEX is
$X = E_{k}(I) \otimes \alpha^j$
What I see a lot in sample code on the Internet is that you start with $T_ = E_{k}(I)$ and use that for the ...
- 217
4
votes
1
answer
656
views
Can you still decrypt XTS if half of the cipher text is deleted?
If a part of my data is damaged, corrupted, or deleted, is it then still possible to decrypt the rest of the data if you still have the key?
The situation: a piece of data (something like a document ...
- 581
7
votes
2
answers
5k
views
Should I use XTS or GCM to encrypt my hard drives?
I want to start encrypting all of my hard drives, but I don't know whether to choose XTS or GCM mode. Why is it that XTS is recommended (since the most websites I visit use GCM in their HTTPS ...
- 581
4
votes
0
answers
427
views
XTS and 256-bit data blocks
I am developer of an application that uses XTS with ciphers which use 128-bit blocks (AES, Serpent and Twofish).
I now want to use XTS with a cipher which uses 256-bit blocks (Shacal-2).
AFAIK, I ...
- 141
6
votes
1
answer
1k
views
How many blocks can securely be encrypted with XTS
I could not find in the NIST recommendations on XTS how many blocks can securely be encrypted with XTS-AES.
Through the recommendations, I've found:
The length of the data unit for any instance of ...
3
votes
0
answers
234
views
Can XTS + checksum be used for authenticated encryption?
Is it possible to use XTS + a checksum for authenticated encryption? Specifically, it seems like a good $n$ bit checksum applied before encryption should ensure that any change to the ciphertext will ...
- 4,813
6
votes
1
answer
1k
views
Is XTS basically the cheapest form of (secure) double-encryption?
XTS, as given by the below equation, is a mode of operation primarily targeting full-disk encryption scenarios.
By the way it works it also doubles the keylength although a meet-in-the-middle attack ...
- 46.3k
9
votes
1
answer
3k
views
Effect of ESSIV when used with XTS
I looked everywhere on the web and I did find a lot of information about full disk encryption, but nothing really answered my question.
When formatting a partition to use LUKS, the two most common ...
- 193
3
votes
1
answer
504
views
Does XTS provide random write access?
I'm trying to find a sufficient encryption mode that supports random read and write access. It seems like XTS is a perfect fit, since in my use case authentication and integrity insurance are handled ...
- 33
0
votes
0
answers
56
views
AES-XTS: find key from ciphertext and plaintext [duplicate]
Let's say I have a plaintext, the corresponding ciphertext encrypted using AES-XTS, and the initialization vectors. Is there any way - not brute force, of course - to compute the key?
Even if there's ...
- 101
0
votes
1
answer
552
views
What is the benefit of applying the tweak a second time using XTS?
I tried to understand the inner working of XTS. What I understood is that it is applying the tweak two times: once on the plaintext and once on the output.
What is the benefit of applying the tweak ...
- 3
3
votes
1
answer
1k
views
Can XEX or XTS modes be used with only one tweak?
XEX Mode (with two tweaks) is the following scheme:
$X = E_{k}(I) \otimes \alpha^j \\
C = E_{K}(P \oplus X) \oplus X$
where $I$ and $j$ are both tweaks (sector number and block number respectively). ...
- 265
6
votes
3
answers
1k
views
Reusing AES-CTR Keys and IVs for File Encryption
I’m implementing some file encryption module with random-access capability and AES-CTR seems the right way to go.
I understand that reusing Keys and IVs can expose the file to ‘Stream Cipher Attacks’ ...
- 63
1
vote
1
answer
2k
views
What is the forward cipher function of AES-XTS?
We're using OpenSSLs EVP_aes_265_xts encryption on data (with unique, random, IVs for every new message encrypted) - which is working well.
But, I've been asked; what is the forward cipher function ...
- 121
25
votes
2
answers
9k
views
Why do we use XTS over CTR for disk encryption?
I'm taking Prof. Boneh's crypto class from Coursera, and am unsure on the requirement for XTS mode for disk encryption.
It seems that CTR mode would do exactly what XTS can do, but is simpler to ...
- 353
1
vote
1
answer
345
views
Compared to GCM or XTS modes, how secure is H xor R1, E (R2, R1, Message) for confidentiality and integrity?
Let R1 and R2 be (32 byte) random values, and let a H = Hash (R1, R2, Message) be of the same length as each R value. Provided E (R2, R1, Message) is operating in some chaining mode, are there any ...
- 111
7
votes
2
answers
2k
views
Is it possible to tweak AES-GCM so that it is satisfactory for whole-disk encryption (like XTS mode)?
Is it possible to leverage a preexisting implementation of AES-GCM to provide the key security benefits essential for full-disk encryption (similar to AES-XTS)?
GCM is a popular encryption mode ...
- 111
9
votes
1
answer
4k
views
Is AES-XTS considered safe to encrypt multiple files with the same keys?
I was wondering if changing the cipher mode to AES-XTS in EncFS would be a sound idea. EncFS uses AES in CBC mode until the last 1KB block, and CFB mode for the last block if ...
- 93
3
votes
4
answers
2k
views
Non-malleable file encryption using AES XTS 256?
I'm looking to do file encryption of a bunch of individual files, some small, some quite large. The files will be write-once/read-many, so I could use CBC, however, since the read-access needs to ...
- 139
37
votes
1
answer
52k
views
What is the advantage of XTS over CBC mode (with diffuser)?
I have some problems in understanding the "advantage" of AES-XTS compared to CBC with diffuser.
I read something about FileVault, in this paper they mention the two modes of operations XTS and CBC (...
- 473