Modes of operationRecommended
XTS mode (XEX-based tweaked-codebook with ciphertext stealing)
Disk and storage encryption mode
How it works
XTS encrypts each disk sector with a 'tweak' derived from the sector number, so identical data in different sectors encrypts differently. Ciphertext is the same size as plaintext, which lets it fit existing disk sectors. It is used by full-disk encryption tools such as BitLocker, FileVault 2 and LUKS.
Sizes: Two AES keys: 256 bits total for XTS-AES-128, 512 bits total for XTS-AES-256
Status: For full-disk and block-storage encryption only.
Strengths
- No ciphertext expansion, so sector sizes do not change.
- Each sector can be read or written independently.
- Approved by NIST (SP 800-38E) for confidentiality on storage devices.
Weaknesses and known attacks
- No authentication: an attacker with write access can corrupt or replay sectors, and changes are not detected.
- Deterministic per sector, so rewriting the same data to the same sector produces the same ciphertext.
Use it for
- Full-disk and volume encryption
Don't use it for
- Network traffic or messages (use GCM or ChaCha20-Poly1305)
Exam tip
If the scenario is full-disk encryption, XTS-AES is the mode. It protects confidentiality of data at rest, not integrity.