Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

looks like NIST only approved GCM mode for authenticated encryption and other modes don't have any approval or a good implementation available.

  • Is that possible a weakness in $GHASH$ compromise plain-text or it just allow attacker to forge it? can we use AES-GCM with confidence or is better to use a confidential only mode for encryption and HMAC cipher-text with same key to protect plain-text in long terms?

  • How strong is GCM authentication compared to HMAC-SHA256? what is poly time to forge plain-text?

  • Where attacker can practically forge plain-text in real life? adding malicious codes to software downloads? what if plain-text is padded? can he identify and change chat messages? where else?

share|improve this question
Probably not relevant (and he notes that you shouldn't try to use his implementation for your own purposes), but AGL has recently implemented ChaCha/Salsa into Chrome: [ link ] – figlesquidge Feb 27 '14 at 17:40
@figlesquidge why in that blog post he says "Chrome talking to Google uses AES-GCM if there's hardware support at the client" ? what is hardware support mean ? – user12253 Feb 27 '14 at 18:40
Aes-gcm is very quick IF the critical calculations can be done in hardware. However, in software a secure implementation is slower than a secure implementation of cha cha/salsa – figlesquidge Feb 27 '14 at 18:45
@figlesquidge what hardware client may have to do that? on server it make sense but in client side we don't have usually custom crypto chips...? – user12253 Feb 27 '14 at 18:57
Modern Intel chips contain special instructions for efficiently calculating aes or certain finite field products, making aes-gcm very quick. There's a paper about it, but I can't give you a link because I'm on my phone – figlesquidge Feb 27 '14 at 19:01
  1. AES-GCM encrypts the plaintext in the Counter Mode. GHASH operates on the resulting ciphertext, so no weakness in GHASH could compromise the confidentiality of plaintext.

  2. The GCM authentication is not as strong as that of SHA-256, in particular on short tags. If the tag is $\tau$-bit, an adversary can forge the tag after $2^{\tau/2}$ attempts given the encryption of a message $2^{\tau/2}$ block long. For 32-bit tags this implies $2^{16}$-block long single message and $2^{16}$ forgery attempts at short messages. For HMAC-SHA256 the corresponding values are $2^{32}$, or $2^{\tau}$ in general case.

share|improve this answer
GHASH use same key we used to encrypt plain-text. if GHASH compromise how encryption key survive as its same thing we used in GHASH ? – user12253 Mar 1 '14 at 14:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.