The problem with a random IV in disk encryption is that you may not have
anywhere to store it, since you're already using all of your disk space.
Using hash of block number as IV works except that in most encryption
modes, if the first part of the plaintext is unchanged, that part of
the ciphertext will also be unchanged.

Better to use an encryption mode where a change anywhere in the plaintext
will affect the whole plaintext.  Then you can use hash of block number as
IV.  This still leaks info about whether a block is changed or unchanged,
but that is hard to avoid unless you are going to re-encrypt the entire
disk any time you change a bit anywhere.  And this way, when a disk
block is changed at all, the entire block ciphertext changes.

Reply via email to