On 8 December 2017 at 02:51, Jason A. Donenfeld <Jason@xxxxxxxxx> wrote: > Hi Eric, > > Nice to see more use of ChaCha20. However... > > Can we skip over the "sort of worse than XTS, but not having _real_ > authentication sucks anyway in either case, so whatever" and move > directly to, "linux finally supports authenticated encryption for disk > encryption!"? Ehm, it doesn't? This is plain ChaCha20, not any AEAD variant. > This would be a big deal and would actually be a > noticeable security improvement, instead of a potentially dubious step > sidewaysbackish. > It is actually dubious, given the large scale reuse of IVs with a stream cipher. I do suppose though that using an AEAD variant would at least catch any attacks involving flipping ciphertext bits resulting in plaintext bits being flipped at the same offset (but file updates would still be visible in the clear) > Bcachefs supports ChaCha20Poly1305, which is pretty neat. From what > I've read, performance is acceptable too. > http://bcachefs.org/Encryption/ > > Jason
