So these days I see everyone using AES-GCM. What are its advantages over simple CTR+HMAC modes? Is it speed? Or ciphertext length? And what are the security tradeoffs, both in terms of practical cryptanalysis and theoretical attacks complexity?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
AES-GCM uses single block cipher operation and can be processed in parallel, therefore it should be faster.
CTR+HMAC requires block cipher and hash function, which usually can't be processed in parallel. Also it requires 2 keys. It is often miss-implemented (MAC-than-encrypt or MAC-and-encrypt, using single key).
Cipher-text length is the same for same security level. However CTR+HMAC usually has longer tag, because hash functions have bigger output than block cipher. But you can truncate tag to same length.
If implemented correctly and block cipher / hash function are secure, both are secure. However, because CTR+HMAC has 2 keys compromising of one part won't compromise the other part.