There are two primary problems with disk encryption. The first is efficiency. Each data block stored on the disk needs to be encrypted independantly of the others to avoid the cost of decoding many blocks just to read one. The second is an attack by analysing the patterns of stored data. For instance, blocks consisting of the plaintext of just zeros will occur at various places. By analysing the patterns of encrypted data at attacker can guess the contents of some blocks, leading to a known plaintext attack, as well as deducing some of the use of the disk.

In addition, the history of cryptography is one of increasingly good cryptanalytic attacks on algorithms, allowing (for instance) known plaintext attacks which are sufficiently more efficient than brute force that such attacks become practical. It's just a matter of time. I'll assume that known plaintext attacks are feasible but brute force is not.

To protect against this, the encryption key for the partition must be varied using the block number to give a different encryption key for each block; and the relationship between the block key and the partition key must resist an attacker who deduces or guesses the key to a block, so that the partition key is secure.

The idea is to safely generate a block key (B) from the partition key (P) and the block number (N). The attacker, of course, knows N.

Given K<D> is the encryption of data D with key K:

B = (P<N>) < (N<P>) >

If the attacker knows B for some N, then N<K>=B is trivial to solve, and K<N>=B in a feasible known plaintext attack. However, if P is unknown, then N<P> is unknown, so K< N<P> > is not a known plaintext attack. P< N<P> > may be good enough, but just in case it may be reducible to K<N>, I prefer the form above. However, this is just my paranoia; YPMV.

This requires an extra 3 encrypt/decrypt operations per block. If the disk block is 1KB and the cypher block size is 256bits (32bytes) then the normal encrypt/decrypt overhead is 32 encryption operations, so the extra overhead in just undor 10%. That seems reasonable for a fairly ductile solution.

What do you think of this idea or comment?
(You can change your vote at any time)

I agree

No opinion

I disagree