Dr. Dobb's Journal - October 2007 - (Page 30)

Core Technology by Mohamed Abo El-Fotouh and Klaus Diepold Inside the Windows Vista Disk Encryption Algorithm Performance matters when security is involved To protect the confidentiality of data stored on hard disks, security applications (called “disk Mohamed is a Ph.D. student at Munich University of Technology. Klaus is the head of the Institute for Data Processing at Munich University of Technology. They can be contacted at mohamed@tum.de and kldi@tum.de, respectively. encryption” applications) are often used. The Windows Vista Enterprise and Ultimate editions, for instance, use Bitlocker Drive Encryption, which encrypts all data on the system volume. And at the heart of Bitlocker is the AES-CBC + Elephant diffuser encryption algorithm (download.microsoft .com/download/0/2/3/0238acaf-d3bf-4a6d-b3d6-0a0be4bbb36e/BitLockerCipher200608.pdf). Figure 1 presents an overview of the AES-CBC + Elephant diffuser (a “diffuser” is a data-mixing function). As you can see, there are four separate operations in each encryption. The plaintext is XORed with a sector key, run through two different diffusers, and then encrypted with the Advanced Encryption Standard (AES) in cipher-block chaining (CBC) mode. Diffuser A runs AC times and Diffuser B runs BC times. In the current Bitlocker implementation, AC=5 and BC=3. Plaintext and key are parameterized; in this article, the parameters we use are: • Plaintext is 512 bytes. The current standard sector size. • Tweak-key is 256 bits. The first 128 bits serve as the drive sector key and the last 128 bits as the Initial Vector (IV) for AES-CBC. • We use the 256-bit key versions of the AES for maximum security. ciphertext will not lead to a predicted change in the plaintext (a bit-flipping attack “where flipping a bit in ciphertext will be associated by a flipping of a certain bit in plaintext”). • Test2 tests if changing any bit in the plaintext will be associated with changing a specific bit(s) in the ciphertext. This assures that manipulating plaintext will not lead to a predicted change in ciphertext. • Test3 measures the avalanche effect in the encryption direction (the effect of changing one bit of plaintext on the ciphertext). A good cipher will have roughly half the bits of the ciphertext changed due to a single bit change in plaintext. • Test4 measures the avalanche effect in the decryption direction (the effect of changing one bit of ciphertext on the plaintext). This is to process the poor man’s authentication; that is, changing one bit in the ciphertext suggests that roughly half the plaintext will be scrambled. Testing Methodology In examining the cryptographic strength of AES-CBC + Elephant, we ran four tests on the cipher: • Test1 tests if changing any bit in the ciphertext will be associated with changing a specific bit(s) in the plaintext. This assures that manipulating 30 Dr. Dobb’s Journal l www.ddj.com l October 2007 AES-CBC + Elephant Diffuser We first tested the current implementation of the cipher using the four tests. The cipher passed them all. Then we studied the ability of reducing the number of runs of Diffuser A and Diffuser B to increase performance. Our results were: http://download.microsoft.com/download/0/2/3/0238acaf-d3bf-4a6d-b3d6-0a0be4bbb36e/BitLockerCipher200608.pdf http://download.microsoft.com/download/0/2/3/0238acaf-d3bf-4a6d-b3d6-0a0be4bbb36e/BitLockerCipher200608.pdf http://www.ddj.com

Table of Contents Feed for the Digital Edition of Dr. Dobb's Journal - October 2007

Cover Contents Hmmmm Alia Vox Developer Diaries Developer’s Notebook AI: It’s OK Again! Conversations Visual Cryptography and Bit-Plane Complexity Segmentation Inside the Windows Vista Disk Encryption Algorithm Memory-Aware Components Software and the Core Description Process Logging In C++ Effective Concurrency The Agile Edge Swaine’s Flames

Dr. Dobb's Journal - October 2007

For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.