What is the disadvantage of AES-GCM mode for authenticated encryption? Why does the CAESAR competition say that it’s one of the goals to find an AE scheme that offers an advantage over AES-GCM? What advantage they are talking about?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
AES-GCM has the following problems:
I suppose one of the problems (they mention several after a short reading) with a mode like GCM is nonce misuse (e.g. reuse). When the key is the same and the nonce is reused, by misunderstanding the concept or by a simple programming error, information about the plain texts can be revealed.
Phillip Rogaway has already defined an encryption mode (SIV, Synthetic IV) which tries to be more robust against nonce misuse. But it is quite slow, as it requires to process the data twice. It is also not "online", as the first data processing must be finished before the second can start.