From: Bruce Momjian [mailto:br...@momjian.us] > On Fri, May 25, 2018 at 08:41:46PM +0900, Moon, Insung wrote: > > BTW, I want to support CBC mode encryption[3]. However, I'm not sure how > to use the IV in CBC mode for this proposal. > > I'd like to hear opinions by security engineer. > > Well, CBC makes sense, and since AES uses a 16 byte block size, you > would start with the initialization vector (IV) and run over the 8k page > 512 times. The IV can be any random value that is not repeated, and > does not need to be secret.
XTS is faster and more secure. XTS seems to be the standard now: https://www.truecrypt71a.com/documentation/technical-details/encryption-scheme/ "c.Mode of operation: XTS, LRW (deprecated/legacy), CBC (deprecated/legacy)" Microsoft Introduces AES-XTS to BitLocker in Windows 10 Version 1511 https://www.petri.com/microsoft-introduces-aes-xts-to-bitlocker-in-windows-10-version-1511 > However, using the same IV for the entire table would mean that people > can detect if two pages in the same table contain the same data. You > might care about that, or you might not. It would prevent detection of > two _tables_ containing the same 8k page. A more secure solution would > be to use a different IV for each 8k page. > > The cleanest idea would be for the per-table IV to be stored per table, > but the IV used for each block to be a mixture of the table's IV and the > page's offset in the table. TrueCrypt uses the 8-byte sector number for the 16-byte tweak value for XTS when encrypting each sector. Maybe we can just use the page number. Regards Takayuki Tsunakawa
