I have a case where it may be possible for an adversary to deduce the plaintext inputs that went into creating a AES-128-GCM encrypted message (there is good IV diversity across the encrypted messages, however) This opens up the potential to expose a GCM "oracle" to the adversary who may additionally be able to adaptively modify the inputs to the encryption function and observe the GCM encrypted outputs. I'm thinking about adding a random string of bytes of some fixed length to each encrypted message in order to prevent this (since an attacker would no be able to guess the random bytes that were appended and would therefore not know the full plaintext for a corresponding ciphertext). Some questions: 1) Can someone provide a "rule of thumb" around how much randomness should be appended to each message of a given length. 2) Does one need to take particular care around how the random byes are added an removed from the message 3) Are there any other methods one can employ in order to avoid exposing the encryption "oracle" described above?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
GCM is authenticated encryption. As such, it is secure against chosen-plaintext attacks and against chosen-ciphertext attacks. Thus, there is no problem whatsoever with the adversary having access to an encryption oracle. It will not help it at all to break any of the encrypted messages.