`Christophe Saout  wrote:>Before encryption the data to be encrypted gets xor'ed with the result>from the previous encrypted block. The idea in cryptoloop is that not>the result from the previous run gets used but a specially constructed>dummy block that has the sector number (little-endian encoded) in the>first four bytes and is null every where else. So you simply get some>additional perturbation based on the sector number, so that zero-filled>sectors always looked differently after encoding.>>When decoding this means that the sector number is xor'ed over the>encrypted block. If, when decoding, the sector number doesn't match that>one that was put in the iv while encoding that sector, you will get>errors in the first four bytes, mostly one or few bits flipped.Unrelated to the corruption issues:Is this how cryptoloop works?  The sector number is used directly as theIV (not the encrypted sector number)?  In other words, if X denotes thefirst block of plaintext and S the sector number, then the first blockof ciphertext is C = E_K(X ^ S)?If yes, I noticed a small security weakness.  This usage of CBC mode canleak a few bits of information about the plaintext data, in some cases.For instance, consider the following example.  Let X denote the first blockof plaintext at sector S, and X' the first block of plaintext at sector S'.Suppose X' = X^1 and S' = S^1 (here "^" denotes xor, as usual).  ThenC = E_K(X^S), and C' = E_K(X'^S') = E_K((X^1)^(S^1)) = E_K(X^S) = C.This condition can be recognized in the encrypted data.In other words, here's the attack.  The attacker looks at two sectors,number S and S', and looks at the first block of ciphertext in each sector,call them C and C'.  If C = C', then the attacker knows thatX = X' ^ S ^ S', where X and X' denote the first block of plaintext ineach sector.  If plaintext were totally random, this would almost neverhappen (with probability 2^-64 for a 64-bit block cipher).  However,plaintext data often isn't exactly random.  There are some plausibleways that the condition X = X' ^ S ^ S' could arise with non-negligibleprobability, and if this happens, information leaks to the attacker.Is this a problem worth fixing?  You'll have to decide.  Fortunately,there is a simple fix: use the encrypted sector number as IV, not theplaintext sector number.  In other words, the IV would be E_K(S), andthus the first block of ciphertext would be C = E_K(X ^ E_K(S)).  Thisfix makes the above attack go away.-To unsubscribe from this list: send the line "unsubscribe linux-kernel" inthe body of a message to majordomo@vger.kernel.orgMore majordomo info at  http://vger.kernel.org/majordomo-info.htmlPlease read the FAQ at  http://www.tux.org/lkml/`