Disk encryption suites generally operate on data in 512-byte
sectors which are individually encrypted and decrypted. These 512-byte sectors alone can use any
block cipher mode of operation (typically
CBC), but since arbitrary sectors in the middle of the disk need to be accessible individually, they cannot depend on the contents of their preceding/succeeding sectors. Thus, with CBC, each sector has to have its own
initialization vector (IV). If these IVs are predictable by an attacker (and the
filesystem reliably starts file content at the same offset to the start of each sector, and files are likely to be largely contiguous), then there is a
chosen plaintext attack which can reveal the existence of encrypted data. The problem is analogous to that of using block ciphers in the
electronic codebook (ECB) mode, but instead of whole blocks, only the first block in different sectors are identical. The problem can be relatively easily eliminated by making the IVs unpredictable with, for example,
ESSIV. Alternatively, one can use modes of operation specifically designed for disk encryption (see
disk encryption theory). This weakness affected many
disk encryption programs, including older versions of
BestCrypt as well as the now-deprecated
cryptoloop. To carry out the attack, a specially crafted plaintext file is created for encryption in the system under attack, to "
NOP-out" the IV such that the first ciphertext block in two or more sectors is identical. This requires that the input to the cipher (plaintext, \scriptstyle P,
XOR initialisation vector, \scriptstyle IV) for each block must be the same; i.e., \scriptstyle P_1 \,\oplus\, IV_1 \;=\; P_2 \,\oplus\, IV_2. Thus, we must choose plaintexts, \scriptstyle P_1,\, P_2 such that \scriptstyle P_1 \,\oplus\, P_2 \;=\; IV_1 \,\oplus\, IV_2. The ciphertext block patterns generated in this way give away the existence of the file, without any need for the disk to be decrypted first. ==See also==