I want to switch from using LUKS for full disk encryption to TRESOR. TRESOR tries to prevent cold boot attacks by storing the encryption key in the CPU's registers. It uses the kernel's crypto API for things like getting IVs and using a mode like XTS. However, the actual key is requested once the kernel boots and any keys passed to the cipher via the crypto API later on are ignored.
When using the XTS mode, the key is usually split in two halves and one is used as the actual key and the other to generate IVs. But since TRESOR ignores all keys, the kernel ends up using two identical AES keys. From what I can gather from this question and the papers linked there, XTS is vulnerable to a chosen cipher text attack when used like that.
Can this become a problem in practice? And which modes of operation can I use instead? From looking at the code, it seems that cbc-essiv also needs to supply its own key.