8 votes
Accepted

Is it problematic to use PBKDF2-HMAC-SHA256 to derive a 512-bit XTS key?

Background. PBKDF2 has a stupid design where generating two blocks of output costs the legitimate user twice as much as generating one block of output, without necessarily putting additional cost on ...
Squeamish Ossifrage's user avatar
8 votes

Should I use XTS or GCM to encrypt my hard drives?

XTS is designed so that the plaintext and ciphertext sizes are the same. This is "needed" for disk encryption in order to preserve the sector size. However, when you are encrypting your disk at the ...
Yehuda Lindell's user avatar
6 votes
Accepted

Should I use XTS or GCM to encrypt my hard drives?

Use XTS for whole-disk encryption. It is designed for that purpose. Definition of XTS mode in wiki is under the Disk Encryption Theory which says enough i think :) ...
Makif's user avatar
  • 820
6 votes
Accepted

XTS or XEX mode?

However all typical disk sector sizes are divisible by AES block size (128bit). So does that mean that disk encryption uses XEX mode and not doing cipher-text stealing at all? Given that XTS is ...
SEJPM's user avatar
  • 46k
6 votes
Accepted

How reassuring is CRC-then-XTS as authenticated encryption?

No, this does not make a deterministic authenticated cipher, unless you're using a secret CRC as a MAC. How do you break it? First, find a pair of messages $m = m_1 \mathbin\| m_2$ and $m' = m'_1 \...
Squeamish Ossifrage's user avatar
6 votes
Accepted

XTS mode with the tweak key as the sole secret

Actually, you can't remove the $E_{k_2}$ as you did. You had: $$C_{j} = E_{K_2}(P_{j} \oplus (K^\prime \otimes \alpha^j)) \oplus (K^\prime \otimes \alpha^j)$$ Let me replace the term $(K^\prime \...
Future Security's user avatar
5 votes
Accepted

Is XTS always better than GCM?

You're trying to compare authenticated encryption with disk encryption. GCM is used to solve 2 security problems at once: encryption and authentication. GCM is designed such that only someone knowing ...
Serpent27's user avatar
  • 1,461
5 votes
Accepted

Is XTS-AES a NIST-approved nonce-misuse-resistant AES mode?

A tweak collision seems to only disclose whether the same plaintext was encrypted with the same key and the same tweak Actually, XTS will disclose whether related plaintexts were encrypted with the ...
poncho's user avatar
  • 147k
5 votes

Non-malleable file encryption using AES XTS 256?

As Paŭlo Ebermann notes in a comment above, the time cost of a proper MAC calculation is almost certainly negligible compared to the cost of reading or writing the data on the disk. Applying a MAC to ...
Ilmari Karonen's user avatar
4 votes
Accepted

How many blocks can securely be encrypted with XTS

From what I understood, data units are sectors, so a sector can have at most $2^{128}-2$ blocks but you can only encrypt $2^{20}$ blocks which cannot be correct (it seems too little compared to a disk'...
otus's user avatar
  • 32.1k
4 votes

Non-malleable file encryption using AES XTS 256?

This appears to be a better question to offer this answer to, in addition to Seth's great answer to the question: "What is the advantage of XTS over CBC mode (with diffuser)?". Non-malleable file ...
Rob's user avatar
  • 290
4 votes
Accepted

Can you still decrypt XTS if half of the cipher text is deleted?

It depends. (Usual answer to this kind of questions. We would need more details about the data damage to answer) XTS encryption mode is short for XEX-based tweaked-codebook mode with ciphertext ...
ddddavidee's user avatar
  • 3,324
3 votes
Accepted

Is multiple encryption with XTS mode susceptible to Meet-in-the-middle attacks?

Short answer is "yes, this setup is vulnerable". If you want some math, you can read an explanation below. In XTS two keys are independent, so it already has 512 bit security (there are no ...
Georgy Firsov's user avatar
3 votes
Accepted

XEX mode - how to perturb the tweak

You then take $T$ and left shift it one bit. If the carry from that operation is a 1, then you XOR in 0x87 on the bottom byte. That becomes the pre- and post-crypto XOR material for the next block and ...
Luis Casillas's user avatar
3 votes
Accepted

Is AES in XTS mode insecure for data stream encryption?

From Ptaeck's site (here) (You linked this) ...
SAI Peregrinus's user avatar
2 votes

How can XTS be used to detect the presence of TrueCrypt hidden volumes?

They don't issue cryptographer's licenses to pseudonymous carrion fowl, so I can't rightly claim to be a cryptographer, but I can confidently say that if there is any problem here it is far more ...
Squeamish Ossifrage's user avatar
2 votes

IEEE P1619/XTS, inconsistent reference implementation and test vectors

From §5.1 ‘Data units and tweaks’, p. 4: Each data unit is assigned a tweak value which is a non-negative integer. The tweak values are assigned consecutively, starting from an arbitrary non-...
Squeamish Ossifrage's user avatar
1 vote

Is it possible for XTS to use two different key sizes?

This is really about key management rather than the AES mode itself, if not you need to supply more details. What's the goal of your suggestion? The threat model? What are the weaknesses you pointed ...
kodlu's user avatar
  • 22.5k
1 vote

Disk encryption and advanced format

This linked article from a related question explains pretty well the problems with full disk encryption (FDE) and why it "sucks". TL;DR: It can't be fully randomized, leading to ...
aiootp's user avatar
  • 773
1 vote

Should I be worried about XTS tampering when encrypting backups using VeraCrypt?

With XTS mode encryption data can be "tampered with" with the caveat that any changes to the data are random and unpredictable to an attacker. Since encryption acts as a pseudo-random ...
Serpent27's user avatar
  • 1,461
1 vote
Accepted

EAX vs CTR vs XTS + cascade ciphers in disk encryption hell

This would allow my system to stay secure even if one of these ciphers has been broken, right? Most likely, however one can construct situations where the cascade is only as strong as the first ...
SEJPM's user avatar
  • 46k
1 vote

XTS mode of operation and authentication

I assume you mean "random access" by "decrypting arbitrary part of ciphertext, operate on it, and securely encrypting it again". The XTS mode is designed as a "Full-Disk Encryption" mode, which ...
DannyNiu's user avatar
  • 9,207
1 vote

AES-XTS vs AES-CTR for Write Once Storage

Analyzing the risks and correctly setting the threat model is important when choosing the encryption schemes. If the attacker is a passive attacker, that he can only read the hard disk while ...
kelalaka's user avatar
  • 48.5k

Only top scored, non community-wiki answers of a minimum length are eligible