Cryptology ePrint Archive: Report 2015/594
Disk Encryption: Do We Need to Preserve Length?
Debrup Chakraborty and Cuauhtemoc Mancillas-Lopez and Palash Sarkar
Abstract: In the last one-and-a-half decade there has been a lot of activity towards development of cryptographic techniques for disk
encryption. It has been almost canonised that an encryption scheme suitable for the application of disk encryption must be
length preserving, i.e., it rules out the use of schemes like authenticated encryption where an authentication tag is also
produced as a part of the ciphertext resulting in ciphertexts being longer than the corresponding plaintexts. The notion of
a tweakable enciphering scheme (TES) has been formalised as the appropriate primitive for disk encryption and it has been argued
that they provide the maximum security possible for a tag-less scheme. On the other hand, TESs are less efficient than some
existing authenticated encryption schemes. Also TES cannot provide true authentication as they do not have authentication tags.
In this paper, we analyze the possibility of the use of encryption schemes where length expansion is produced for
the purpose of disk encryption. On the negative side, we argue that nonce based authenticated encryption schemes are not appropriate
for this application. On the positive side, we demonstrate that deterministic authenticated encryption (DAE) schemes may
have more advantages than disadvantages compared to a TES when used for disk encryption. Finally, we propose a new deterministic
authenticated encryption scheme called BCTR which is suitable for this purpose. We provide the full specification of BCTR, prove
its security and also report an efficient implementation in reconfigurable hardware. Our experiments suggests that BCTR performs
significantly better than existing TESs and existing DAE schemes.
Category / Keywords: secret-key cryptography / Disk encryption, Tweakable Enciphering Schemes, Deterministic Authenticated Encryption.
Date: received 15 Jun 2015
Contact author: debrup at cs cinvestav mx
Available format(s): PDF | BibTeX Citation
Version: 20150621:163041 (All versions of this report)
Short URL: ia.cr/2015/594
Discussion forum: Show discussion | Start new discussion
[ Cryptology ePrint archive ]