Consider switching from AES CTR to AES XTS #3230

New Issue

exarkun · 2019-07-25T13:26:42Z

exarkun commented

2019-07-25 13:26:42 +00:00

After discussion with #cryptography-dev about random access AES CTR support in the cryptography library, it sounds like a better move would be for Tahoe-LAFS to switch this primitive to AES XTS instead. AES XTS is designed with random access in mind.

Obviously there are more factors to consider than just ease of random access. The outcome of this ticket should be an enumeration and consideration of all such factors along with a decision about whether they indicate sticking with AES CTR or switching to AES XTS.

After discussion with #cryptography-dev about random access AES CTR support in the `cryptography` library, it sounds like a better move would be for Tahoe-LAFS to switch this primitive to AES XTS instead. AES XTS is designed with random access in mind. Obviously there are more factors to consider than *just* ease of random access. The outcome of this ticket should be an enumeration and consideration of all such factors along with a decision about whether they indicate sticking with AES CTR or switching to AES XTS.

exarkun added the

labels 2019-07-25 13:26:42 +00:00

exarkun added this to the undecided milestone 2019-07-25 13:26:42 +00:00

exarkun commented

2019-07-25 13:34:00 +00:00

Somewhere, likely, there should also be a task to survey more recent cryptographic tools that might serve here. AES XTS (or, I guess, "XTS-AES") was standardized 12 years ago. I have done no investigation to determine how well or poorly it has aged.