Fast wideblock AES disk encryption in Linux?
2
votes
1
answer
449
views
I recently learned that Linux supports Adiantum as a disk encryption cipher (run
cryptsetup benchmark -c xchacha20,aes-adiantum-plain64
to try it out on your system). While Adiantum is primarily meant to provide faster disk encryption for low-end devices that do not support hardware AES acceleration, it is also a wide block cipher mode, meaning that a single bit flip in the ciphertext randomizes an entire sector of plaintext, whereas in AES-XTS mode (the current recommended cipher when AES acceleration is available) a single bit flip in the ciphertext randomizes only a 16 byte block of plaintext. That gives a potential attacker much more granularity and block boundaries to work with. So in this respect Adiantum is strictly more secure than AES-XTS.
Adiantum is a construction built from a hash, a bulk cipher and a block cipher. The currently available variants in my Linux kernel (v5.4) use ChaCha12 or ChaCha20 as bulk cipher. For the intended use on devices without hardware AES acceleration that is great, but now I also want to use it on my laptop with AES acceleration where AES-XTS is about twice as fast as Adiantum.
Are there any wide block ciphers for disk encryption optimized for hardware AES acceleration available for Linux, or being worked on?
@anyone from the future, if the answer is 'no' at the time I'm writing this but has changed by the time you read this question, please do post an answer with the updates at your time.
Asked by JanKanis
(1421 rep)
Jan 13, 2023, 04:31 PM
Last activity: Apr 18, 2024, 10:08 PM
Last activity: Apr 18, 2024, 10:08 PM