8
votes
Accepted
Is it problematic to use PBKDF2-HMAC-SHA256 to derive a 512-bit XTS key?
Background.
PBKDF2 has a stupid design where generating two blocks of output costs the legitimate user twice as much as generating one block of output, without necessarily putting additional cost on ...
- 49.5k
6
votes
Accepted
XTS or XEX mode?
However all typical disk sector sizes are divisible by AES block size (128bit). So does that mean that disk encryption uses XEX mode and not doing cipher-text stealing at all?
Given that XTS is ...
- 46.4k
6
votes
Accepted
How reassuring is CRC-then-XTS as authenticated encryption?
No, this does not make a deterministic authenticated cipher, unless you're using a secret CRC as a MAC.
How do you break it? First, find a pair of messages $m = m_1 \mathbin\| m_2$ and $m' = m'_1 \...
- 49.5k
6
votes
Accepted
XTS mode with the tweak key as the sole secret
Actually, you can't remove the $E_{k_2}$ as you did. You had:
$$C_{j} = E_{K_2}(P_{j} \oplus (K^\prime \otimes \alpha^j)) \oplus (K^\prime \otimes \alpha^j)$$
Let me replace the term $(K^\prime \...
- 3,333
5
votes
Accepted
Is XTS-AES a NIST-approved nonce-misuse-resistant AES mode?
A tweak collision seems to only disclose whether the same plaintext was encrypted with the same key and the same tweak
Actually, XTS will disclose whether related plaintexts were encrypted with the ...
- 151k
5
votes
Accepted
Is XTS always better than GCM?
You're trying to compare authenticated encryption with disk encryption. GCM is used to solve 2 security problems at once: encryption and authentication. GCM is designed such that only someone knowing ...
- 1,471
5
votes
Non-malleable file encryption using AES XTS 256?
As Paŭlo Ebermann notes in a comment above, the time cost of a proper MAC calculation is almost certainly negligible compared to the cost of reading or writing the data on the disk.
Applying a MAC to ...
- 46.5k
4
votes
Non-malleable file encryption using AES XTS 256?
This appears to be a better question to offer this answer to, in addition to Seth's great answer to the question: "What is the advantage of XTS over CBC mode (with diffuser)?".
Non-malleable file ...
- 290
3
votes
Accepted
Is multiple encryption with XTS mode susceptible to Meet-in-the-middle attacks?
Short answer is "yes, this setup is vulnerable". If you want some math, you can read an explanation below.
In XTS two keys are independent, so it already has 512 bit security (there are no ...
- 255
3
votes
Accepted
XEX mode - how to perturb the tweak
You then take $T$ and left shift it one bit. If the carry from that operation is a 1, then you XOR in 0x87 on the bottom byte. That becomes the pre- and post-crypto XOR material for the next block and ...
- 14.7k
3
votes
Accepted
Is AES in XTS mode insecure for data stream encryption?
From Ptaeck's site (here) (You linked this)
...
- 5,899
2
votes
How can XTS be used to detect the presence of TrueCrypt hidden volumes?
They don't issue cryptographer's licenses to pseudonymous carrion fowl, so I can't rightly claim to be a cryptographer, but I can confidently say that if there is any problem here it is far more ...
- 49.5k
2
votes
IEEE P1619/XTS, inconsistent reference implementation and test vectors
From §5.1 ‘Data units and tweaks’, p. 4:
Each data unit is assigned a tweak value which is a non-negative integer. The tweak values are assigned consecutively, starting from an arbitrary non-...
- 49.5k
1
vote
Is it possible for XTS to use two different key sizes?
This is really about key management rather than the AES mode itself, if not you need to supply more details.
What's the goal of your suggestion? The threat model? What are the weaknesses you pointed ...
- 23.7k
1
vote
Disk encryption and advanced format
This linked article from a related question explains pretty well the problems with full disk encryption (FDE) and why it "sucks".
TL;DR: It can't be fully randomized, leading to ...
- 1,122
1
vote
Should I be worried about XTS tampering when encrypting backups using VeraCrypt?
With XTS mode encryption data can be "tampered with" with the caveat that any changes to the data are random and unpredictable to an attacker. Since encryption acts as a pseudo-random ...
- 1,471
1
vote
Accepted
EAX vs CTR vs XTS + cascade ciphers in disk encryption hell
This would allow my system to stay secure even if one of these ciphers has been broken, right?
Most likely, however one can construct situations where the cascade is only as strong as the first ...
- 46.4k
1
vote
XTS mode of operation and authentication
I assume you mean "random access" by "decrypting arbitrary part of ciphertext, operate on it, and securely encrypting it again".
The XTS mode is designed as a "Full-Disk Encryption" mode, which ...
- 9,795
1
vote
AES-XTS vs AES-CTR for Write Once Storage
Analyzing the risks and correctly setting the threat model is important when choosing the encryption schemes.
If the attacker is a passive attacker, that he can only read the hard disk while ...
- 49.5k
Only top scored, non community-wiki answers of a minimum length are eligible