I am trying to learn more about GCM mode and how it differs between CBC. I already know that GCM provides a MAC which is used for message authentication. From what I have read, and seen code snippets of is that GCM does an exlusive or much like CBC, but I'm not sure what the exclusive-or is against. In CBC mode, the exlusive-or is plaintext against the previous ciphertext block, except for the first block which uses a random IV. Does GCM do the same, or does it do the exclusive-or against something else? If so, can someone please briefly explain how GCM uses the IV and how the exclusive-or is done.
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
GCM and CBC modes internally work quite differently; they both involve a block cipher and an exclusive-or, but they use them in different ways.
In CBC mode, you encrypt a block of data by taking the current plaintext block and exclusive-oring that wth the previous ciphertext block (or IV), and then sending the result of that through the block cipher; the output of the block cipher is the ciphertext block.
GCM mode provides both privacy (encryption) and integrity. To provide encryption, GCM maintains a counter; for each block of data, it sends the current value of the counter through the block cipher. Then, it takes the output of the block cipher, and exclusive or's that with the plaintext to form the ciphertext.
Note two key differences:
As for how GCM uses an IV (I personally consider 'nonce' a better term for what GCM uses, because that emphesizes the idea that with GCM, you cannot use the same nonce for the same key twice), well, it is used to initialize the counter.