Wide-Block Cipher Support and HCTR2
summary
Linux adds HCTR2 to the Crypto API as a wide-block HCTR2 construction that targets 4096-byte sectors and filename encryption in ext4 and f2fs, trading diffusion for stronger tamper resistance. It composes two POLYVAL hashing rounds and one AES-based XCTR round, reusing AES-NI to accelerate it, and demonstrates about 1.7× slower encryption overhead than AES-XTS at large I/O sizes. The mode implements a tweakable SPRP/PRP so IV reuse across sectors is safe and small edits no longer reveal 16-byte-local changes.
AI-written summary · about
chapters (18)
- 0:00Intro
- 0:43Storage Encryption
- 1:20IV Reuse in Disk Encryption
- 2:29Narrow Block Modes
- 3:42Narrow Block Sector Modification
- 4:42Disk Corruption Granularity
- 5:42Randomized Corruption
- 6:56How to Fix
- 9:01Wide Block Sector Modification
- 9:25Wide Block Ciphers (Tweakable PRPs)
- 10:07IV Reuse in Filename Encryption
- 12:03Variable Length Ciphers (Tweakable SPRP)
- 13:06Tweakable SPRP to Tweakable PRP
- 13:35Tweakable SPRP to AEAD
- 14:25Advantages over XTS
- 15:33Disadvantages
- 16:17TSPRP Support in Linux kernel
- 22:51Use Cases in Kernel
related talks
33mBringing fscrypt Encryption to CephFS Userspace
33mEncryption for filesystems with advanced features new fscrypt functionality
41mCryptographic speed, reliability & security
28mSpeculative Encryption on GPU Applied to Cryptographic File Systems
49mCryptech - Open Hardware Security Modules for a safer, open world
36mUnder Lock & Key: Using Hardware Protected Keys with the Linux Crypto API
27mCoupling Key-Ring and Linux Crypto-API Framework(LCF) via Crypto-Transformation(tfm)
42mEverything I always wanted to know about crypto