Does XTS provide random write access? I'm trying to find a sufficient encryption mode that supports random read and write access. It seems like XTS is a perfect fit, since in my use case authentication and integrity insurance are handled elsewhere, and from my current understanding, these are the only two drawbacks of XTS.

The only thing I don't get (yet) is: I'm not supposed to encrypt any data with the same key and IV twice, right? Now, what if I edit one of the XTS encrypted blocks? The tweak will stay the same since it depends on the block location, so if I use the same key again, this premise is violated. If I use a new key, I'd have to encrypt the whole file again, which means I don't really have random access anymore.

I feel like I got something wrong here. Can someone enlighten me please – and/or maybe even suggest a sufficient mode if XTS is not it?

Thanks in advance.
XTS has been designed for disk encryption, where an attacker typically has access to the disk only a single time (when they steal/confiscate the device).

When an attacker sees several ciphertexts encrypted using the same key, they can tell which blocks differ between the versions, but not the content of the blocks. Compare this with CTR mode, which leaks which bits differ, which is far worse.

XTS should be used when an attacker typically sees only one version, but it doesn't fail completely when they see several.



As an alternative, you could either increase the effective block size. Since blocks being identical becomes rarer with longer blocks, this reduces the leak, but it doesn't eliminate it. BEAR, LION, LIONESS, "wide blockcipher" EME and AEZ might be worth reading about (I'm not familiar with the details of these).

Or you could store an IV alongside each sector of ciphertext, replacing it by a new IV when overwriting. If you use a 16 byte IV and 4096 byte sectors, this is an overhead of 0.4%. The bigger downside is that you won't have a direct mapping between equal sized plaintext and ciphertext blocks, which may impact performance and prevents write-through.

You can't avoid information leaks completely, if you can't afford per-sector IVs and need random write access.