SECURING FIBRE CHANNEL FABRICS - Brocade

Modes of Operationencryption process. Furthermore, all subsequent blocks arechained in such a way that the encryption process depends on allpreviously encrypted blocks.• Counter (CTR). Converts a block cipher into a stream cipher byencrypting successive blocks in a data stream using a counter tochange the value for each block.• Galois Counter Mode (GCM). A similar mode of operation to theCounter mode with the addition of an authentication componentcalled the Galois mode. Authentication is usually a computingintensiveprocess, which would not be acceptable for streamingdata. Authentication is also necessary to prevent certain types ofattack on a data stream. The Galois mode was developed toauthenticate a message at very high speeds with minimal performanceimpact on the data throughput. GCM is used by theBrocade encryption solution to encrypt streaming tape data.• XEX-based Tweaked Codebook with Stealing (XTS). This mode ofoperation was designed for data formats that are not evenly divisibleby a given block size, as is the case for disk drives with sectorsnot evenly divisible by their block size. XTS is used by the Brocadeencryption solution to encrypt block data on disk drives.DES/3DESThe National Standards Bureau (NSB) recognized the need for a government-widestandard for the encryption of non-classified, sensitivedata and developed a cryptographic algorithm to address this requirement.The first draft of the algorithm was written by IBM and was calledLUCIFER. The name was eventually changed to the Data EncryptionStandard (DES) and it was adopted as an official standard in 1976. Thealgorithm is a symmetric-key algorithm with 56-bit keys that determinewhich bits will be transposed and substituted in the original message.DES was broken by a brute force attack in 1999 by the Electronic FrontierFoundation (EFF), making it imperative to come up with a newcryptographic standard for the Federal Government. Selecting a newcryptographic standard is a complex and lengthy process, since proposedalgorithms must be given the test of time and should providethe opportunity to have as many people attempt to break it as possible.In the interim, it was crucial to replace DES with a new algorithmwith a larger key space, since DES was no longer secure. The simplestsolution was to use a modified application of DES until the new standardcould be adopted.Securing Fibre Channel Fabrics 83