17 votes

Why not authenticate full-disk encryption?

Authentication and probabilistic encryption are two desirable features which each take up a small amount of extra space. And you are absolutely right that the percentage of space consumed is of no ...
kasperd's user avatar
  • 1,377
14 votes

Why not authenticate full-disk encryption?

So, are there reasons for not using authentication that I'm missing? I believe that the real reason is not actually space, but time. As you said, storing the tags would not require that much space. ...
poncho's user avatar
  • 147k
13 votes
Accepted

Fast cipher without needing hardware support (like ChaCha20) for disk encryption

Adiantum1 is a wide-block cipher built out of ChaCha12, NH-Poly1305, and—for only a small part of the computation—AES. Being a wide-block cipher, Adiantum can encrypt, for example, entire 512-byte or ...
Taylor R Campbell's user avatar
13 votes
Accepted

Why not authenticate full-disk encryption?

With 4096-byte sectors, space is a complete non-issue, less than 1 % Problem 1: 10GB per TB is not a "complete non-issue" for many people. Problem 2: If the checksums are inside of their data ...
deviantfan's user avatar
  • 1,187
8 votes

Why not authenticate full-disk encryption?

The threat it protects against is uncommon Encryption protects against an attacker who gains hold of the data. The typical threat is the theft of a laptop or a backup tape, the compromise of a remote ...
Gilles 'SO- stop being evil''s user avatar
8 votes

Should I use XTS or GCM to encrypt my hard drives?

XTS is designed so that the plaintext and ciphertext sizes are the same. This is "needed" for disk encryption in order to preserve the sector size. However, when you are encrypting your disk at the ...
Yehuda Lindell's user avatar
7 votes
Accepted

What would be the maximum acceptable block size for disk enryption?

AES-XTS is a mode of operation of AES that encrypts blocks, but is not a blockcipher. It has the security drawback that when information in a large block changes locally (e.g. a single byte), it's ...
fgrieu's user avatar
  • 141k
6 votes
Accepted

Should I use XTS or GCM to encrypt my hard drives?

Use XTS for whole-disk encryption. It is designed for that purpose. Definition of XTS mode in wiki is under the Disk Encryption Theory which says enough i think :) ...
Makif's user avatar
  • 820
5 votes
Accepted

Ephemeral Encryption Keys

The answer is in what Apple means by "ephemeral session key". See the BlackHat session starting around 12:00 in. The raw file encryption keys are wrapped with a ephemeral key when outside the SEP (...
zaph's user avatar
  • 917
4 votes

Has anyone seen a stream cipher being used for FDE

The problem with full-disk encryption is that you don't want to "waste" space on authentication tags (because it would result in odd sector sizes or in a large latency / overhead on-disk). So we can'...
SEJPM's user avatar
  • 46k
4 votes

How does LUKS encrypt the master key?

G'day. LUKS stores multiple copies of the master key in what it terms key slots. Each key-slot contains an encrypted copy of the master key, and it can vary in its password-based KDF parameters (and ...
brynk's user avatar
  • 318
4 votes
Accepted

When using CBC-ESSIV for disk encryption, why does the generation of IV require a hash then encryption instead of only one hash?

Block cipher encryption $$\operatorname{Enc}(K,P): \{0,1\}^k \times \{0,1\}^n \rightarrow \{0,1\}^n$$ is a permutation where a $K \in \mathcal{K}$ select a permutation from all possible permutations ...
kelalaka's user avatar
  • 48.5k
4 votes
Accepted

Regarding XEX mode

Why isn't this construction used instead of XEX? Because XEX takes a block cipher and constructs a tweakable block cipher out of it, whereas this construction, usually called Even-Mansour, takes a ...
SEJPM's user avatar
  • 46k
3 votes
Accepted

Security of McCallum-Relyea exchange

Interestingly, the confidentiality of the scheme is as strong as the confidentiality of $C$ independent of hardness assumptions (apart from the strength of the symmetric cipher and the secure deletion ...
Daniel S's user avatar
  • 23.9k
3 votes
Accepted

Does passphrase length impact read-write speed?

If I had chosen a 25-character key would this process be faster? That would depend entirely on how Diskcryptor was designed; but it appears it would not. According to the Diskcryptor homepage, ...
poncho's user avatar
  • 147k
3 votes

Disk encryption using AES-CBC: is reliance on previous block data a downside?

As you know, it makes reading and writing the disk very slow if all the data in the drive is chained together. If so, writing to a drive of size $n$ at position $p$ will require $\Theta (n-p)$ time. ...
v7d8dpo4's user avatar
  • 198
3 votes

LUKS: decrypting with master-key rather than with passphrase

Normally, you don't provide the master key directly. The master key is protected by a key encryption key. All storage encryption systems work this way. There is no way to change the master key ...
Gilles 'SO- stop being evil''s user avatar
3 votes

Are Iphones' content encrypted?

The iPhone is built with encryption inserted automatically when writing to flash memory and decryption inserted automatically when reading from it. This happens with all files, all the time. There is ...
Martin Kochanski's user avatar
2 votes

Why not authenticate full-disk encryption?

In order to create anything but garbage sectors in an encrypted file system, you need to have the secret key anyway, so there is only little gain. The only use case would be when you want to give ...
Simon Richter's user avatar
2 votes

Why not authenticate full-disk encryption?

The technical arguments (space /performance) are actually red herrings. Authentication can be implemented in many ways, and not necessarily on a per sector basis. It's mainly files that require ...
Paul Uszak's user avatar
  • 15.4k
2 votes
Accepted

Can wiping a disk writing zeros on an encrypted device be a weak point?

The output of an encrypted stream of zeros is absolutely indistinguishable from random data. What you do is not write zeros to the block device for the drive, but for the encrypted mapping. That is, ...
forest's user avatar
  • 15.3k
2 votes

How can XTS be used to detect the presence of TrueCrypt hidden volumes?

They don't issue cryptographer's licenses to pseudonymous carrion fowl, so I can't rightly claim to be a cryptographer, but I can confidently say that if there is any problem here it is far more ...
Squeamish Ossifrage's user avatar
2 votes

confusion about LUKS encryption

Data is encrypted with Data Encryption Key. Each slot encrypts the DEK using a Key Encryption Key derived from a passphrase. Access to the DEK gets you the data. Access to any of the KEKs will give ...
Z.T.'s user avatar
  • 824
2 votes

How to determine the fastest OpenSSL cryptographic algorithm

It's always best to wipe disks using the ATA SECURE ERASE command directly to the drive. This command lets you wipe data that simply isn't visible to even the Operating System. It is a direct command ...
Maarten Bodewes's user avatar
  • 92.6k
2 votes

How can an adversary request decryption of an unused sector?

For why the model assumes adversaries can read the decrypted version of the sectors they can change (meaning they get access to a sector decryption oracle), see SEJPM's answer. For how adversaries ...
fgrieu's user avatar
  • 141k
2 votes
Accepted

How can an adversary request decryption of an unused sector?

I understand that an adversary is capable of modifying an unused sector, but can anyone explain how they would be able to request its decryption? The first thing to understand here is that this is an ...
SEJPM's user avatar
  • 46k
2 votes

May specifying the position of swapfile help defeat LUKS encryption?

This will not give an attacker any useful information for cryptanalysis. Knowing where encrypted data is doesn't help an attacker learn anything about how to decrypt the data. They can get the same ...
SAI Peregrinus's user avatar
2 votes

May specifying the position of swapfile help defeat LUKS encryption?

No, specifying the swap offset does not help an attacker. Kerckhoffs's principle states that a secure cryptosystem must be designed such that the only material that needs to be secret is the key. Any ...
forest's user avatar
  • 15.3k
1 vote

Are brute-force attacks made more difficult by removing the LUKS header?

If we look at a sample Luks header ( The tables taken from here ) Luks Partition Header (PHDR) consists of the necessary information to decrypt/encrypt the luks device as followings, ...
kelalaka's user avatar
  • 48.5k
1 vote

Decently safe amount of AES key derivation?

VeraCrypt tries each hash and cipher combination with your supplied password if PKCS5-PRF is set to auto-detection on the enter password screen, i.e. it will try ...
kelalaka's user avatar
  • 48.5k

Only top scored, non community-wiki answers of a minimum length are eligible