# Security of authenticated encryption modes gcm & ccm

I have two questions for Clarification for AE mode choice criteria

• GCM : it appears to be actually the most popular and widely used AE mode of operation. however it is also well-known to be highly sensitive (more than other AE modes ?) to IV uniqueness requirement and completely fails if such requirement is not respected'. I personnaly in regard with planned target domain of application consider this as a weakness . So such weakness should'not weight in the criteria for AE mode selection ? Remain GCM the one of most powerful AE mode despite this weakness ? isn't EAX or OCB if no more patented a more efficient & secure choice ?

• CCM : I understood via such mode review that it is based on MacThenEncrypt procedure (CBC-MAC then CTR ) . So why is such mode always presented as candidate AE mode if only Encrypt-Then-Mac procedure seems actually recommended by cryptography experts ?
-
Are you asking why GCM and CCM are NIST approved, while EAX and OCB are not? csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf csrc.nist.gov/publications/nistpubs/800-38C/… –  Henrick Hellström Jun 15 '13 at 14:30
If robustness is more important than performance, then I prefer HMAC+encryption in a encrypt-then-MAC scheme over GCM and the like. –  CodesInChaos Jun 15 '13 at 16:07
response to Hendrick comment –  william_fr Jun 15 '13 at 18:05
The mode that's least sensitive to IVs is SIV mode. $\;$ –  Ricky Demer Jun 16 '13 at 1:48
Another issue - completely unrelated to security - is that CCM is simply hard to implement and use, because it does not use static data sizes. This is especially true regarding generation of the NONCE, especially regarding size. I've already met an implementation that was correct but slightly incompatible with mine. –  owlstead Jun 24 '13 at 11:33
I think you are mistaken. If you need 128 bit of security in a IND-CCA2 model, you clearly can't use a mode that allows you to create forgeries with significantly better than $2^{-128}$ probability with realistic amounts of data. You do need IND-CCA2 security for online data transmission protocols, so with OCB mode you have to rekey long before you reach even MB of data transmitted using a key. –  Henrick Hellström Jun 17 '13 at 7:16