[dm-crypt] Efficacy of xts over 1TB

Arno Wagner arno at wagner.name
Sun Jul 25 17:32:49 CEST 2010

On Sun, Jul 25, 2010 at 03:14:24PM +0200, Christoph Anton Mitterer wrote:
> On Sun, 2010-07-25 at 14:25 +0200, Milan Broz wrote:
> > Just please note one thing, which is dm-crypt special here:
> > 
> > default "plain IV" is 32 bit only, so if anyone uses it on >2TB partition
> > some sectors shares IV (IV generator restarts, opening it to to watermarking
> > and similar attacks).
> > 
> > Please _always_ use plain64 (*aes-xts-plain64*) if you want use it for large
> > devices. (plain64 produces the same IV for <2TB.
> > Available since 2.6.33, Truecrypt 7 already does that, thanks:-)
> 1) What's the maximum size a partition can (securely) have with plain64?

That would be larger than you can buy ;-)

512B * 2 ^64 = 9444 EB = 9.2 * 10^21 B

> 2) Is plain64 solwer than the the normal plain? If not,... and even
> if,.. wouldn't it be better to let "plain" be what currently "plain64"
> is and to add a e.g. "plain32" or so, which people can use if the really
> know what they're doing?

I suspect backwards compatribility and not everybody running a 
kernel >= 2.6.33
> 3) In any case,.. this should go in the FAQ, Arno, can you add this
> please?

I will. Once I have seen an XTS spec ;-)


Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno at wagner.name 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier 

More information about the dm-crypt mailing list