XTS was designed for transparent encryption modules: black boxes, inserted somewhere in the data path between the Host and the storage media. XTS does not use any metadata, normally available in storage systems, including a possibly variable record length. This restriction caused criticisms: the security or the performance could be better with using extra info. On the other hand, there could be many different architectures, with different metadata, so a general solution is hard to find.
Accordingly, the block size must always be the same in a particular XTS implementation.
Another consequence of the transparency design constraint is that the length of the data must not change with encryption. (This requirement was also widely criticized, because in many storage systems the data layout on the storage media could be changed, while this change remains hidden from the Host. Nevertheless, this could cause compatibility issues with the storage device, and again, a general solution for most practical cases looks hard.)
Accordingly, you must use the specified ciphertext stealing, and no data padding.
Laszlo Hars
Seagate
John Markey <jkmarkey@xxxxxxxxxxxx>
