From: Ard Biesheuvel Subject: Re: [PATCH] fscrypt: add support for ChaCha20 contents encryption Date: Fri, 8 Dec 2017 07:20:43 +0000 Message-ID: References: <20171208013838.105034-1-ebiggers3@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Cc: Eric Biggers , linux-fscrypt@vger.kernel.org, "Theodore Ts'o" , linux-ext4@vger.kernel.org, linux-f2fs-devel@lists.sourceforge.net, linux-mtd@lists.infradead.org, linux-fsdevel@vger.kernel.org, Linux Crypto Mailing List , Jaegeuk Kim , Michael Halcrow , Paul Crowley , Martin Willi , David Gstir , Eric Biggers To: "Jason A. Donenfeld" Return-path: In-Reply-To: Sender: linux-crypto-owner@vger.kernel.org List-Id: linux-ext4.vger.kernel.org On 8 December 2017 at 02:51, Jason A. Donenfeld wrote: > Hi Eric, > > Nice to see more use of ChaCha20. However... > > Can we skip over the "sort of worse than XTS, but not having _real_ > authentication sucks anyway in either case, so whatever" and move > directly to, "linux finally supports authenticated encryption for disk > encryption!"? Ehm, it doesn't? This is plain ChaCha20, not any AEAD variant. > This would be a big deal and would actually be a > noticeable security improvement, instead of a potentially dubious step > sidewaysbackish. > It is actually dubious, given the large scale reuse of IVs with a stream cipher. I do suppose though that using an AEAD variant would at least catch any attacks involving flipping ciphertext bits resulting in plaintext bits being flipped at the same offset (but file updates would still be visible in the clear) > Bcachefs supports ChaCha20Poly1305, which is pretty neat. From what > I've read, performance is acceptable too. > http://bcachefs.org/Encryption/ > > Jason