Institute of Electrical and Electronics Engineers
The Institute of Electrical and Electronics Engineers (IEEE) is a 501(c)(3) professional association for electronic engineering and electrical engineering (and associated disciplines) with its corporate office in New York City and its operation ...
(IEEE) standardization project for encryption of stored data, but more generically refers to the Security in Storage Working Group (SISWG), which includes a family of standards for protection of stored data and for the corresponding cryptographic key management.
Standards
SISWG oversees work on the following standards:
The base IEEE 1619 Standard Architecture for Encrypted Shared Storage Media uses the
XTS-
Advanced Encryption Standard
The Advanced Encryption Standard (AES), also known by its original name Rijndael (), is a specification for the encryption of electronic data established by the U.S. National Institute of Standards and Technology (NIST) in 2001.
AES is a variant ...
(
XEX XEX may refer to
Radio stations
*XEX-TDT (channel 14, virtual 5) in Altzomoni, Méx.
*XEX-AM, 730 kHz in Mexico City
*XEX-FM, 101.7 MHz in Mexico City
Other uses
* Xor–encrypt–xor (XEX), a (tweakable) mode of operation of a block cipher. ...
-based Tweaked CodeBook mode (TCB) with
ciphertext stealing
In cryptography, ciphertext stealing (CTS) is a general method of using a block cipher mode of operation that allows for processing of messages that are not evenly divisible into blocks without resulting in any expansion of the ciphertext, at the c ...
(CTS); the proper name should be XTC (XEX TCB CTS), but that acronym is already used to denote the drug
ecstasy.
The P1619.1 Authenticated Encryption with Length Expansion for Storage Devices uses the following algorithms:
*
Counter mode with CBC-MAC (CCM)
*
Galois/Counter Mode
In cryptography, Galois/Counter Mode (GCM) is a mode of operation for symmetric-key cryptographic block ciphers which is widely adopted for its performance. GCM throughput rates for state-of-the-art, high-speed communication channels can be achiev ...
(GCM)
*
Cipher Block Chaining
In cryptography, a block cipher mode of operation is an algorithm that uses a block cipher to provide information security such as confidentiality or authenticity.
A block cipher by itself is only suitable for the secure cryptographic transforma ...
(CBC) with
HMAC
In cryptography, an HMAC (sometimes expanded as either keyed-hash message authentication code or hash-based message authentication code) is a specific type of message authentication code (MAC) involving a cryptographic hash function and a secret ...
-Secure Hash Algorithm
*
XTS-
HMAC
In cryptography, an HMAC (sometimes expanded as either keyed-hash message authentication code or hash-based message authentication code) is a specific type of message authentication code (MAC) involving a cryptographic hash function and a secret ...
-Secure Hash Algorithm
The P1619.2 Standard for Wide-Block Encryption for Shared Storage Media has proposed algorithms including:
* XC
* EME2
The P1619.3 Standard for Key Management Infrastructure for Cryptographic Protection of Stored Data defines a system for managing encryption data at rest security objects which includes architecture, namespaces, operations, messaging and transport.
P1619 also standardized the key backup in the
XML
Extensible Markup Language (XML) is a markup language and file format for storing, transmitting, and reconstructing arbitrary data. It defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. T ...
format.
Narrow-block vs. wide-block encryption
An encryption algorithm used for data storage has to support independent encryption and decryption of portions of data. So-called narrow-block algorithms operate on relatively small portions of data, while the wide-block algorithms encrypt or decrypt a whole
sector
Sector may refer to:
Places
* Sector, West Virginia, U.S.
Geometry
* Circular sector, the portion of a disc enclosed by two radii and a circular arc
* Hyperbolic sector, a region enclosed by two radii and a hyperbolic arc
* Spherical sector, a po ...
. Narrow-block algorithms have the advantage of more efficient hardware implementation. On the other hand, smaller block size provides finer granularity for data modification attacks. There is no standardized "acceptable granularity"; however, for example, the possibility of data modification with the granularity of one bit (
bit-flipping attack
A bit-flipping attack is an attack on a cryptographic cipher in which the attacker can change the ciphertext in such a way as to result in a predictable change of the plaintext
In cryptography, plaintext usually means unencrypted information ...
) is generally considered unacceptable.
For these reasons, the working group selected the narrow-block (128 bits) encryption with no authentication in the standard P1619, assuming that the added efficiency warrants the additional risk. But recognizing that wide-block encryption might be useful in some cases, another project P1619.2 has been started to study the usage of wide-block encryption.
The project is maintained by the IEEE Security in Storage Working Group (SISWG). Both the disk storage standard P1619 (sometimes called P1619.0) and the tape storage standard P1619.1 were standardized in December 2007.
A discussion was ongoing on standardization of the wide-block encryption for disk drives, like
CMC and EME as P1619.2, and on key management as P1619.3.
LRW issue
From 2004 to 2006, drafts of the P1619 standards used the
Advanced Encryption Standard
The Advanced Encryption Standard (AES), also known by its original name Rijndael (), is a specification for the encryption of electronic data established by the U.S. National Institute of Standards and Technology (NIST) in 2001.
AES is a variant ...
(AES) in
LRW mode. In th
30 Aug 2006meeting of the SISWG, a straw poll showed that most members would not approve P1619 as it was. Consequently, LRW-AES has bee
tweakable block cipher in P1619.0 Draft 7 (and renamed to XTS-AES in Draft 11). Some members of the group found it non-trivial to abandon LRW, because it had been available for public peer-review for many years (unlike most of the newly suggested variants). The issues of LRW were:
# An attacker can derive the LRW tweak key K2 from the ciphertext if the plaintext contains K2, , 0
n or 0
n, , K2. Here , , is the concatenation operator and 0
n is a zero block. This may be an issue for software that encrypts the partition of an operating system under which this encryption software is running (at the same time). The operating system could write the LRW tweak key to an encrypted swap/hibernation file.
# If the tweak key K2 is known, LRW does not offer indistinguishability under chosen plaintext attack (IND-CPA) anymore, and the same input block permutation attacks of ECB mode are possible.
Leak of the tweak key does not affect the confidentiality of the plaintext.
See also
*
Comparison of disk encryption software
This is a technical feature comparison of different disk encryption software.
Background information
Operating systems
Features
* Hidden containers: Whether hidden containers (an encrypted container (A) within another encrypted container (B) ...
*
Disk encryption
Disk encryption is a technology which protects information by converting it into unreadable code that cannot be deciphered easily by unauthorized people. Disk encryption uses disk encryption software or hardware to encrypt every bit of data that g ...
*
Encryption
In cryptography, encryption is the process of encoding information. This process converts the original representation of the information, known as plaintext, into an alternative form known as ciphertext. Ideally, only authorized parties can decip ...
*
Full disk encryption
Disk encryption is a technology which protects information by converting it into unreadable code that cannot be deciphered easily by unauthorized people. Disk encryption uses disk encryption software or hardware to encrypt every bit of data that g ...
*
Key management
Key management refers to management of cryptographic keys in a cryptosystem. This includes dealing with the generation, exchange, storage, use, crypto-shredding (destruction) and replacement of keys. It includes cryptographic protocol design, ...
*
Key Management Interoperability Protocol
The Key Management Interoperability Protocol (KMIP) is an extensible communication protocol that defines message formats for the manipulation of cryptographic keys on a key management server. This facilitates data encryption by simplifying encrypti ...
*
On-the-fly encryption
Disk encryption is a technology which protects information by converting it into unreadable code that cannot be deciphered easily by unauthorized people. Disk encryption uses disk encryption software or hardware to encrypt every bit of data that g ...
References
External links
SISWG home pageEmail archivefor SISWG in general and P1619 in particular
Email archive for P1619.1(Authenticated Encryption)
Email archive for P1619.2(Wide-block Encryption)
Email archive for P1619.3(Key Management) (withdrawn)
{{IEEE standards
Cryptography standards
IEEE standards
Disk encryption