What is the aes-xts key-size?

"Ronan Pigott" <[email protected]> Tue, 25 Jul 2023 19:48:58 +0000
Newsgroups dev.linux.lists.cryptsetup
Message-ID <[email protected]>
Hi cryptsetup,

I'm confused about the doubling/halving behavior of aes-xts mode.

When I run cryptsetup benchmark, it indicates that aes-xts 256b is narrowly the
fastest on my machine:

#     Algorithm |       Key |      Encryption |      Decryption
        aes-cbc        128b      1987.5 MiB/s      7633.5 MiB/s
    serpent-cbc        128b       136.7 MiB/s       991.3 MiB/s
    twofish-cbc        128b       300.7 MiB/s       651.5 MiB/s
        aes-cbc        256b      1501.7 MiB/s      6416.8 MiB/s
    serpent-cbc        256b       136.6 MiB/s       981.6 MiB/s
    twofish-cbc        256b       293.1 MiB/s       645.3 MiB/s
        aes-xts        256b      6089.6 MiB/s      5870.8 MiB/s
    serpent-xts        256b       868.9 MiB/s       885.9 MiB/s
    twofish-xts        256b       594.4 MiB/s       597.1 MiB/s
        aes-xts        512b      5441.2 MiB/s      5601.0 MiB/s
    serpent-xts        512b       867.0 MiB/s       881.4 MiB/s
    twofish-xts        512b       591.5 MiB/s       608.8 MiB/s

However, I still don't understand what should I use as the argument to
--key-size.

The man page says:

> For XTS mode you can optionally set a key size of 512 bits with the -s option.
> Key size for XTS mode is twice that for other modes for the same security
> level.

The arch wiki [1] says:

> By default a 512 bit key-size is used for XTS ciphers. Note however that XTS
> splits the supplied key in half, so this results in AES-256 being used.

This post on stack overflow [2] says:

> Likewise, if you specify --key-size 512, then a 512-bit key will be loaded via
> cryptsetup, but XTS-AES will split it into two 256-bit keys.

all of which have failed to clarify this confusion for me, because I don't know
what is being tested in the benchmark.

What should the argument of --key-size be, 256 or 512, to achieve this superior
performance?

[1] https://wiki.archlinux.org/title/Dm-crypt/Device_encryption#Cryptsetup_usage
[2] https://superuser.com/questions/1428775/what-is-the-default-encryption-key-size-for-dm-crypt-cryptsetup-in-luks-mode

Thanks,
Ronan