# Attacking both authenticity and secrecy in authenticated encryption modes

looks like NIST only approved GCM mode for authenticated encryption and other modes don't have any approval or a good implementation available.

• Is that possible a weakness in $GHASH$ compromise plain-text or it just allow attacker to forge it? can we use AES-GCM with confidence or is better to use a confidential only mode for encryption and HMAC cipher-text with same key to protect plain-text in long terms?

• How strong is GCM authentication compared to HMAC-SHA256? what is poly time to forge plain-text?

• Where attacker can practically forge plain-text in real life? adding malicious codes to software downloads? what if plain-text is padded? can he identify and change chat messages? where else?

-
Probably not relevant (and he notes that you shouldn't try to use his implementation for your own purposes), but AGL has recently implemented ChaCha/Salsa into Chrome: [ link ] – figlesquidge Feb 27 '14 at 17:40
@figlesquidge why in that blog post he says "Chrome talking to Google uses AES-GCM if there's hardware support at the client" ? what is hardware support mean ? – user12253 Feb 27 '14 at 18:40
Aes-gcm is very quick IF the critical calculations can be done in hardware. However, in software a secure implementation is slower than a secure implementation of cha cha/salsa – figlesquidge Feb 27 '14 at 18:45
@figlesquidge what hardware client may have to do that? on server it make sense but in client side we don't have usually custom crypto chips...? – user12253 Feb 27 '14 at 18:57
Modern Intel chips contain special instructions for efficiently calculating aes or certain finite field products, making aes-gcm very quick. There's a paper about it, but I can't give you a link because I'm on my phone – figlesquidge Feb 27 '14 at 19:01

1. AES-GCM encrypts the plaintext in the Counter Mode. GHASH operates on the resulting ciphertext, so no weakness in GHASH could compromise the confidentiality of plaintext.

2. The GCM authentication is not as strong as that of SHA-256, in particular on short tags. If the tag is $\tau$-bit, an adversary can forge the tag after $2^{\tau/2}$ attempts given the encryption of a message $2^{\tau/2}$ block long. For 32-bit tags this implies $2^{16}$-block long single message and $2^{16}$ forgery attempts at short messages. For HMAC-SHA256 the corresponding values are $2^{32}$, or $2^{\tau}$ in general case.

-
GHASH use same key we used to encrypt plain-text. if GHASH compromise how encryption key survive as its same thing we used in GHASH ? – user12253 Mar 1 '14 at 14:52