Re: Threat Model
On Tuesday 13 April 2004 03:08 pm, Williams, Jim wrote:
> I am certainly sympathetic with the above arguments.
>
> However, EME has some pretty big holes:
> [...]
I wholeheartedly agree. As I wrote before, I think that one should
only use (plain vanilla) EME when absolutely forced to use length-
preserving encryption. And I worry that we don't stress that enough.
> I was specifically talking about the addition of the 64 bit "Block guard"
> which I believe is under discussion in T11. Perhaps someone can be more
> specific here.
So maybe I don't understand what you mean by a "Block guard". I
thought you were referring to additional 64 bits that are attached
to every sector, and are checked at decryption time. This is just
an authentication tag. Is "Block guard" something else?
> [...]
> As such, the requirement is that any modification of the data (other than
> replay) results in a probability no more than 2^-64 that the result
> will pass the block guard check. This is a potentially easier requirement
> to meet that the requirement that the decrypted data look random.
Well, formally speaking it is not (but it would be a weaker if you
replace 2^{-64} with, say, 2^{-63}).
-- Shai