9
votes
3answers
286 views

AES-GCM Disadvantage

What is the disadvantage of AES-GCM mode for authenticated encryption? Why does the CAESAR competition say that it’s one of the goals to find an AE scheme that offers an advantage over AES-GCM? What ...
3
votes
1answer
110 views

AES256-GCM - can someone explain how to use it securely (ruby)

I am looking into using AES256-GCM for encrypting some database fields. I know that for AES256-CBC, I need to generate a new IV for each encrypt, but I can use the same key. The IV can be openly ...
2
votes
2answers
138 views

Is there a point using GCM block chiper with Authenticated DH?

I'm delivering shared secret with DH exchange, using a static key for signing and an ephemeral for session, so is there a point using GCM for encrypting the data, or is a simple CBC/CTR block cipher ...
4
votes
1answer
228 views

GCM vs CTR+HMAC tradeoffs

So these days I see everyone using AES-GCM. What are its advantages over simple CTR+HMAC modes? Is it speed? Or ciphertext length? And what are the security tradeoffs, both in terms of practical ...
-1
votes
1answer
95 views

Attacking both authenticity and secrecy in authenticated encryption modes

looks like NIST only approved GCM mode for authenticated encryption and other modes don't have any approval or a good implementation available. Is that possible a weakness in $GHASH$ compromise ...
7
votes
2answers
1k views

Practical disadvantages of GCM mode encryption

It seems that GCM mode encryption has a clear advantage over CBC + HMAC in the sense that it only requires a single key. But it seems that there are some experts here that do not trust it enough to ...
1
vote
1answer
322 views

How to supply the GCM authentication tag to the OpenSSL command line tools?

I'm using AES-256-GCM for authenticated encryption. In order to decrypt, the ruby OpenSSL library requires an auth_tag parameter (in addition to the key and iv). ...
5
votes
1answer
242 views

Does the GCM authentication tag need to be protected?

I am just learning about the GCM mode of AES and I'd like to start using it in my software. However, I have a question about its use. As I understand it the output of a GCM encryption operation is ...
3
votes
2answers
493 views

RSA digital signature vs authenticated cipher

I want to provide both confidentiality and integrity for data at rest (many large files stored on disk). I plan to encrypt the data using AES, which will cover the confidentiality requirement. So ...
5
votes
1answer
431 views

How to use GCM mode and associated-data properly

I'm currently migrating a project to use the bouncy castle GCM mode. I understand that using an authenticated mode removes the need for a HMAC, however I want to be sure that I'm using this mode ...
1
vote
1answer
730 views

AES GCM symmetric encryption of data at rest in c#, ciphertext much longer than plaintext

I've written encryption/decryption routines using AES GCM. Code can be found here. I recently realized that the cipher text is longer than I believe it should be. It should add the tag and IV onto ...
4
votes
1answer
184 views

How to communicate authentication tag for GCM?

I have written some code to do AES in GCM. I currently manually append the tag property to the ciphertext, is this the proper way to communicate the authentication tag?