This article was accepted into the corpus but its outbound wikilinks were never NER-processed — typical at the deepest BFS hop or when the run's entity cap was reached. No expansion funnel to show.
| XTS-AES | |
|---|---|
| Name | XTS-AES |
| Type | Block cipher mode |
| Caption | XTS mode using AES as the underlying cipher |
| Designers | IEEE P1619, NIST |
| Publish date | 2010 |
| Block size | 128-bit |
| Key size | 256-bit or 512-bit (two AES keys) |
| Rounds | AES rounds (10/12/14) |
| Related | Advanced Encryption Standard, CBC mode, CTR mode, LRW mode |
XTS-AES XTS-AES is a disk encryption mode specified for use with the Advanced Encryption Standard to protect data at rest on storage devices. It was developed to meet requirements for sector-level confidentiality in hardware and software storage systems and adopted in standards addressing storage protocols and file systems. XTS-AES aims to provide tweakable block cipher properties suited to fixed-size data units such as disk sectors, balancing security goals with performance and implementability in diverse platforms.
XTS-AES was specified by the IEEE working group behind IEEE P1619 and incorporated into guidance from NIST and industry specifications used by vendors such as Microsoft and Apple. The mode combines two instances of AES under separate keys to create a tweakable block cipher suitable for sector-oriented storage used by Seagate, Western Digital, and cloud providers including Amazon Web Services and Google Cloud Platform. It replaced earlier proposals like LRW mode in many applications because of its standardized status and explicit handling of sector numbering and block indexing used by ATA and SCSI interfaces common to Dell, HP Inc., and Lenovo platforms.
XTS-AES constructs a tweakable encryption primitive by applying two AES keys: one to compute a tweak from the sector or data unit number and one to encrypt the payload blocks. The design draws on concepts from tweakable block cipher research and is related to constructions used in LRW mode and ECB mode mitigations. Typical implementation uses AES-128 or AES-256 cores—products from Intel and AMD with hardware acceleration like AES-NI reduce latency. The tweak is combined with plaintext blocks using finite field multiplication in GF(2^128), a technique influenced by algebraic work referenced alongside implementations in OpenSSL, LibreSSL, and WolfSSL. Design documents discuss interaction with filesystem-level metadata in NTFS, APFS, and ext4.
Academic and industry cryptanalysts from institutions such as University of California, Berkeley, Cryptography Research, Inc., MIT, and ETH Zurich have evaluated XTS-AES. Analyses highlight that XTS-AES provides strong confidentiality when sectors are independently randomized but does not provide authenticated encryption, a critique echoed by researchers affiliated with RSA Security and Google's security teams. Practical attacks exploiting metadata manipulation or sector reordering have been demonstrated in security conferences like USENIX Security Symposium, CRYPTO, and EUROCRYPT; these exploit lack of integrity protection rather than weaknesses in AES itself, which remains vetted through scrutiny by Joan Daemen, Vincent Rijmen, and panels associated with the NIST AES competition. Researchers have proposed mitigations involving higher-level integrity layers similar to designs used by IPsec and TLS.
XTS-AES is engineered for bulk encryption workloads common in SAN arrays, NAS appliances, and client device storage where throughput matters for vendors including Samsung and Micron Technology. Hardware implementations leverage instructions sets like AES-NI on Intel processors and dedicated controllers in Samsung SSDs to achieve high gigabyte-per-second performance. Software implementations in projects such as dm-crypt (used in Linux distributions), BitLocker (used by Microsoft Windows), and FileVault (used by Apple macOS) show tradeoffs between CPU usage, parallelizability, and latency. Benchmarks published by organizations like SPEC and reviewers at Phoronix compare XTS-AES against modes like CBC mode and GCM for I/O-bound workloads.
XTS-AES is included in standards and guidelines from IEEE, NIST Special Publication 800-38E (informative for disk encryption), and storage specifications from T10 and T13 committees governing SCSI and ATA respectively. Operating system vendors (Microsoft, Apple, Canonical) and appliance manufacturers incorporate XTS-AES in default or optional encryption stacks for Windows, macOS, and Ubuntu. Cloud providers such as Microsoft Azure and Google Cloud Platform offer disk encryption options compatible with XTS-AES semantics for block storage volumes used by enterprises and research institutions like CERN and NASA.
Alternatives to XTS-AES include authenticated modes and constructions like Galois/Counter Mode, AES-GCM-SIV, and file-system-integrated designs using EME or SRTP-style authenticated encryption. For sector-based encryption, LRW and EME were earlier contenders; modern deployments often prefer combining XTS-AES for confidentiality with separate integrity/authentication layers as seen in dm-integrity and Linux Kernel features. Comparative evaluations by NIST, academic teams at University of Cambridge, and industry labs at Intel Labs analyze trade-offs in security guarantees, performance on ARM versus x86 architectures, and compatibility with standards used by Oracle and IBM storage solutions.
Category:Block cipher modes