We are using the encryption built into Solaris 11 ZFS, which offers the choice between CCM (CBC counter mode) and GCM (Galois counter mode). What are the pros and cons of choosing each of these cipher modes?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
CCM (Counter with CBC-MAC)
GCM (Galois Counter Mode)
GCM should be considered superior to CCM for most applications that require authenticated encryption. Because of the authentication that happens, GCM is not susceptible to the bit flipping and other attacks that can be mounted against counter mode or other stream modes.
There are some nuances that should be noted before using GCM that involve maximum size of the encrypted message and the MAC size. These are called out in the standard (NIST SP800-38D).