Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

We are using the encryption built into Solaris 11 ZFS, which offers the choice between CCM (CBC counter mode) and GCM (Galois counter mode). What are the pros and cons of choosing each of these cipher modes?

share|improve this question
    
GCM might be a bit faster(depends on CPU), but I don't like it. It feels very fragile. –  CodesInChaos Mar 27 '13 at 12:03
1  
@CodesInChaos: why do you think GCM "feels very fragile"? My chief reservation about it is that it is not widely implemented yet, and that makes it next to impossible to use in some contexts (e.g. Java Card Classic). –  fgrieu Mar 27 '13 at 14:08
1  
Unless you have any special requirements, either would be fine. Both modes are approved by NIST. Personally I prefer the design of GCM. It's a bit more modern than CCM (EAX mode was proposed as a replacement for CCM). More specs on GCM here, and CCM here. –  hunter Mar 27 '13 at 14:51
    
As Hunter says, can you not use EAX or one of the other storage-specific options? [ another reference] –  figlesquidge Dec 19 '13 at 14:56

1 Answer 1

up vote 2 down vote accepted

CCM (Counter with CBC-MAC)

  • Message authentication (via CBC-MAC) is done on the plaintext not the ciphertext. (This is generally not a desireable feature.)
    • On the encrypt operation, the encryption and MAC could happen in parallel, but generally do not (typically because there is just one AES engine in a chip, just one AES thread at a time, etc.). Similar statement is true for decrypt.
  • Performance costs essentially 2 x AES operations per block
  • Not nearly as widely used as GCM
  • Cannot be parallelized

GCM (Galois Counter Mode)

  • Message authentication (via GMAC/GHASH) is done on the ciphertext. (This is desirable most of the time.) Note that in most implementations, the auth check and decryption happen in parallel for performance reasons.
  • Performance costs 1 x AES operation and 1 x GHASH per block (GHASH generally faster than AES, so GCM is faster)
  • Starting to become more widely used and implemented. For example, it is the only authenticated encrypted mode that is implemented in OpenSSL (even though CCM and GCM are part of the TLS RFC).
  • Encrypt/decrypt of multiple blocks can be parallelized nicely

GCM should be considered superior to CCM for most applications that require authenticated encryption. Because of the authentication that happens, GCM is not susceptible to the bit flipping and other attacks that can be mounted against counter mode or other stream modes.

There are some nuances that should be noted before using GCM that involve maximum size of the encrypted message and the MAC size. These are called out in the standard (NIST SP800-38D).

share|improve this answer
    
Great answer - Thanks! –  ruief Oct 3 at 18:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.