Re: The official disk encryption guide seems a bit lacking (detailed list of concrete improvement suggestions!)

[Ellie <el%horse64.org@localhost>]

On 10/28/26 9:06 AM, nia wrote:
> I asked about this a while ago, and was told that the implementation
> of AES-CBC in cgd(4) offers theoretical better security. AES-XTS
> offers theoretical better performance. 
I always thought that XTS was the more secure one, due to supposedly 
being a little more tampering resistant: 
https://crypto.stackexchange.com/questions/5587/what-is-the-advantage-of-xts-over-cbc-mode-with-diffuser

But I'm not at all an expert, so I apologize if XTS over CBC is actually 
a bad idea.

Perhaps it might be useful if the guide had a few notes on *why* a 
specific option is recommended over another.

Regards,

Ellie