....

[Anonymous <nobody@replay.com>]

> For fast file-system crypto, you really want to implement the ciphers
> so that you encrypt several blocks at a time.  
...
> I'd like to know how this method compares to using an interleaved cbc
> mode - for example 8-way interleaved cbc.  The n-way interlaved
> cbc-mode works by chaining each n'th block together instead of each
> block. [...] Am I missing something?

In either case, you need to be sure that changed data is always encrypted with
different parameters -- that is, a changed file should be encrypted with a new
IV or different offset into S1 and S2. Otherwise, the attacks used to recover
badly wiped information could be used to look back in time, so to speak, and
figure out which portions of the file were changed. It's more of a problem if
you're using ofb o ecb o ofb (i.e., the CFS mode) than an interleaved CBC mode.

The 8-way interleaved CBC mode should have different IVs for each "lane" (that
is, a monster 512-bit IV) -- otherwise, files data types with repetitions in
the headers could be identified. The IV should be secret to completely rule out
leakage. However, there are some important restrictions on how you can use the
key in making an IV -- I suggest something like this to ensure nothing is
messed up: hash the passphrase into K0, use nDES-OFB with K0 to make a K1 and
K2, then nDES-OFB with K1 for making the IVs which nDES-interleaved-CBC uses
with K2 for the actual encryption.

> 
> astor
> 
> -- 
>  Alexander Kjeldaas, Guardian Networks AS, Trondheim, Norway
>  http://www.guardian.no/