Tweakable Enciphering Modes for Sector-Level Encryption

We describe block-cipher modes of operation that turn an n-bit block cipher into a tweakable enciphering scheme that acts on sectors of mn bits, where m ≥ 2. When the underlying block cipher is secure in the sense of a strong pseudorandom permutation (PRP) our schemes are secure in the sense of variableinput-length, tweakable, strong PRP. Such an object can be used to encipher the sectors of a disk, in-place, offering security as good as can be obtained in this setting. Our main scheme, EME, does a pass of masked-ECB encryption, a lightweight mixing step, and then a pass of masked-ECB decryption. This mode is parallelizable. Another variant, CMC, makes a pass of CBC encryption, a lightweight mixing step, and then a pass of CBC decryption. This mode is not parallelizable, but it does slightly less total work than EME.