While it does not offer authentication (integrity verification), its design is purpose-built for the low-level constraints of sector-based storage, making it the current industry standard for disk encryption implementations.
$$T_j = AES_K2(i) \otimes \alpha^j$$ Where $\otimes$ is multiplication in Galois Field GF(2^128).