-
Notifications
You must be signed in to change notification settings - Fork 300
What are the advantages of EME? I think that this project is insanely impressive, so I believe that it is the better choice, but for a crypto-noob like me its not obvious:
- According to your thread model it seems to be a potential security issue to not just use GCM, which resulted in you using HKDF just in order to mitigate it
- It seems to be very hard to interact in other languages since EME is more niche, to the point that gocryptfs-inspect gave up on it and "just" uses the socket interface.
Can you give me any hints of what the advantage of EME is?
All reactions
Replies: 1 comment 5 replies
All reactions
Yes, all correct. File name encryption must be deterministic. This rules out AES-GCM.
Then there's the issue that file name length is limited on disk, so you don't want a lot of encryption overhead.
EME is zero-overhead.
At that point in time I expected EME to gain more traction, but it ultimately did not (XTS "won").
I was not aware that gocryptfs-inspect does not implement EME, maybe that can be fixed?
C++-to-Python converter maybe? https://github.com/bailey27/cppcryptfs/blob/master/libcppcryptfs/crypt/eme.cpp
And I guess there's reference implementations in C somewhere.
All reactions
thank you both so much!
And for future reference: I later saw that there is a fork that seems to implement it! https://github.com/maxpat78/gocryptfs-inspect/blob/master/aes256eme.py
All reactions
Nice find! I took the opportunity and added a list of implementations here: https://github.com/rfjakob/eme?tab=readme-ov-file#other-implementations
All reactions
I re-read about XTS again, and now I remember the problem it has: It encrypts 16-byte blocks independently. Quoting https://sockpuppet.org/blog/2014/04/30/you-dont-want-xts/ :
The wide-block-of-narrow-blocks property weakens XTS unnecessarily. As the disk rewrites a given sector, attackers can collect fine-grained (16 byte) ciphertexts. They get to manipulate ciphertexts surgically. It would have been possible to define a "native" wide-block tweakable cipher without that property, but that wouldn’t have been as performant.
For file names, this means that you leak which filenames contain the same 16-byte substrings.
EME encrypts the whole plaintext together as a single block. Changing a single bit changes the whole ciphertext. The price to pay (and probably why XTS won) is performance. EME does two encryption passes. For file names this doesn't matter, it's plenty fast.
All reactions
very interesting! Thank you for the insight