[dm-crypt] Efficacy of xts over 1TB
arno at wagner.name
Sun Jul 25 17:28:55 CEST 2010
On Sun, Jul 25, 2010 at 02:25:32PM +0200, Milan Broz wrote:
> On 07/25/2010 12:34 PM, Arno Wagner wrote:
> > This would be a reason to stay away from XTS, something may have
> > been subtly messed up.
> > As a side note, the XTS spec seems to be behind a IEEE paywall, which
> > would be another reason not to use it, public standards need to be
> > accessible for free.
> You should then suggest not use hardisks and storage technologies too
> because most of standards are not accesible for free:-)
The drafts are free ;-)
> Seriously, XTS-AES is FIPS140-2 approved and I see no problem to use it.
Well, I basically do not see the algorithm. Maybe searching for 15
Minutes was not enough, but when something is hidden in Crypto,
I always become very suspicuous.
> Also read
> Yes, final version is not available but draft specification is still there
> (this is IEEE business, not hiding algorithm definition IMHO).
Have a link to it?
Seriously, I suspect XTS is fine, but not finding the description
and detailed security analysis online bothers me more than a bit.
> Just please note one thing, which is dm-crypt special here:
> default "plain IV" is 32 bit only, so if anyone uses it on >2TB partition
> some sectors shares IV (IV generator restarts, opening it to to watermarking
> and similar attacks).
That was the thing with dm-crypt, yes.
> Please _always_ use plain64 (*aes-xts-plain64*) if you want use it for large
> devices. (plain64 produces the same IV for <2TB.
> Available since 2.6.33, Truecrypt 7 already does that, thanks:-)
Ok. Will put that in the FAQ in a few days.
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno at wagner.name
GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans
If it's in the news, don't worry about it. The very definition of
"news" is "something that hardly ever happens." -- Bruce Schneier
More information about the dm-crypt