The Galois Counter Mode, an authenticated encryption mode of operation for a block cipher.

learn more… | top users | synonyms

1
vote
0answers
12 views

Do Wegman-Carter authenticators allow key reuse if the authenticator result is kept secret?

Poly1305 (and GHASH) are secure authenticators, but only for one use. Thus, nonce reuse in Poly1305-AES, ChaCha20-Poly1305, and AES-GCM all reveal the authentication key. However, my understanding ...
4
votes
1answer
101 views

Security of encrypting many short values with AES in GCM mode

We intend to encrypt certain values in a database which holds personal information such as addresses so as to prevent data leakage should the database be compromised. The intention is that each field ...
3
votes
1answer
35 views

Is the length limit of AES-GCM per key or per (key, nonce) pair?

AES-GCM has a limit on the length of the plaintext it encrypts: $2^{39} - 256$ bits. But is this limit per key or per (key, nonce)? That is, if I encrypt a message with the maximum length, and encrypt ...
10
votes
2answers
132 views

Plain text size limits for AES-GCM mode just 64GB?

Based on NIST SP 800-38D section 5.2.1.1, it seems that the maximum length of plaintext is 2^39-256 bits ~ 64 GB. We've got 100+GB files in genomics that need to be GCM encrypted so are concerned ...
3
votes
1answer
39 views

Randomness and increment of nonce in GCM

2 questions about nonce usage in GCM: Is it safe to use non-random nonce in GCM? Say I use 0x1 for m1, 0x2 for m2, so on. How much should a nonce increased for a file? Say I use 0x1000 as a nonce to ...
1
vote
0answers
37 views

AES-GCM Hash sub key parameter in Intel's IPsec library

I am trying to use Intel's optimized AES-128-GCM implementation (from the Intel white paper “Fast Multi-buffer IPsec Implementations on Intel Architecture Processors”, you can find the code here). ...
-2
votes
1answer
48 views

programming a sniffer for AES GCM with gcrypt

I want to write a sniffer that can read AES-GCM communication using the gcrypt lib I can see in the manual that for encryption there is an additional 2 methods (for AEAD) but what about decryption ? ...
1
vote
0answers
103 views

bank websites using AES_256_CBC vs AES_128_GCM/CBC [duplicate]

Hello i have just recently started learning about cryptography, so i was doing some little research on what kind of encryption techniques and modes that were used in bank web pages. I have noticed ...
3
votes
1answer
60 views

How can there be AES-256-GCM, when GCM is defined for 128-sized blocks?

In both node.js and OpenSSL, I am seeing cipher "aes-256-gcm". However, in NIST Special Publication 800-38D, that defines GCM, I am reading: The underlying block cipher shall be approved, the ...
2
votes
0answers
34 views

Reference AES-NI assembler code for AES-128-GCM? [closed]

I want to implement AES-128-GCM in assembler using Intel AES-NI instructions. I have found reference code in the Intel AES-NI Whitepaper but I don't see code for the GCM mode there (or indeed any use ...
0
votes
1answer
56 views

Using AWS KMS with AES GCM

I am implementing client-side encryption for data stored in AWS DynamoDB, and was wondering about the correct use of AWS KMS for key management in addition to using AES/GCM. I am using the master key ...
3
votes
2answers
74 views

Securely generating auth tokens

(Disclaimer: I'm an experienced server-side Java programmer, but with little crypto experience.) Objective: I've got a login server which, given a login+password pair, should issue a unique auth ...
2
votes
1answer
94 views

Is it an overkill to add external integrity check to the AES-GCM encoding?

There is a java library for android which implements integrity checking to predefined encrypting mode(which can be found here). Short class description from author page to avoid further questions ...
3
votes
1answer
51 views

IV larger than block size of cipher?

Is there any advantage to using an IV larger than a cipher's block size? Say I'm using AES-256 in Galois Counter Mode (GCM). My file format looks like this: ...
0
votes
0answers
8 views

With AES-GCM, can the encrypted and non-encrypted parts be hashed separately? [duplicate]

The hash function in AES-GCM takes encrypted and unencrypted parts. Can the two parts be provided in either order? I'm wondering whether there is any fun with $GF(2^{128})$ that can be done to ...
0
votes
1answer
68 views

Why does TLS 1.2 use GCM with additional SHA hash? [duplicate]

I am studying the cipher suites provided by TLS 1.2 and found an interesting question. TLS 1.2 adopts GCM for encryption and SHA256 or SHA384 for hash (e.g. TLS_RSA_WITH_AES_128_GCM_SHA256). But, GCM ...
1
vote
2answers
156 views

Is my protocol that uses hybrid cryptography and AES-GCM secure?

I'm having a lot of trouble trying to understand how to implement AES-GCM. My usecase: Person A sent me a file with a gauranteed unique name. I want to be assured it was from person A, and that no ...
3
votes
1answer
61 views

Why is GCM only usable for ciphers with a 128-bit block size?

All block cipher modes of operation that I understand are generic schemes. They are not restricted by key size or block size. So why is GCM restricted to 128-bit block size?
2
votes
1answer
168 views

Obtain 384 bits from a 256bit MasterSecret

I'm currently implementing, with crypto++, and AES tranmsission system, whose key is based on a previous ...
4
votes
0answers
47 views

Are there any test vectors for the CMS content type AuthEnvelopedData (for AES-GCM)?

I am looking for CMS AuthEnvelopedData test vectors for AES-GCM mode. I haven’t seen any ready-to-use test vectors for it. There are test vectors for AES-GCM mode but not for its CMS support. I even ...
2
votes
1answer
59 views

Can we use the authentication tag as Nonce / IV for the next message?

Let's assume we're in some scenario requiring transfer of large amounts of data. This means we can only use AES-GCM chunk-for-chunk as its maximal size is restricted to a few GiBs. This means we have ...
14
votes
2answers
352 views

Is (AES-)GCM parallelizable?

I recentely faced the issue of random access decryption while AES-GCM was being used. I said this person that the underlying CTR should allow parallelization but I have no idea how authentication ...
2
votes
0answers
120 views

What are the constraints on using GCM with a tag size of 96 and 128 bits

Say we want to use AES (or any other secure 128 bit block cipher) with GCM and a tag size of 96 or 128 bits. I'm assuming an AES key size of 128 bits and an IV size of 96 bits (the default). NIST ...
2
votes
2answers
84 views

Can we solve the Hidden Number Problem in $GF(2^n)$?

Is it possible to solve the Hidden Number Problem in extension fields? In particular in $GF(2^n)$? Let's suppose an attacker knows some least/most significant bits of $r_i = a_i \times k$ in a given ...
1
vote
1answer
59 views

Execution speed of AES_128 GMAC operation

I have read about the speed performance of AES_128_GCM on specific processors Intel and AMD that support AES New Instruction set. As compared with CMAC and HMAC is it relatively slow for other ...
2
votes
1answer
132 views

How bad it is using the same IV twice with AES/GCM?

I understand that initialization vectors should not be used twice when using AES/GCM. I am using a counter as initialization vector. Every time I send out a new packet (I am developing an UDP based ...
4
votes
1answer
218 views

Ciphertext and tag size and IV transmission with AES in GCM mode

I am completely new to using AES in GCM mode of operation, and I have not a very large background in cryptography as well. I have been playing with OpenSSL trying to encrypt and decrypt some messages. ...
2
votes
2answers
95 views

3DES over Galois Counter Mode (GCM) for authenticated encryption

Is it possible to use DES or 3DES over Galois Counter Mode (GCM) to provide authenticated encryption? I haven't seen any implementation yet.
0
votes
1answer
55 views

What is the proper usage of GCM nonce in TLS1.2?

I have written a program with the help of the bouncy castle for C# library. I am monitoring the traffic which is send between the client and the server and found something (i find) strange. The ...
1
vote
0answers
30 views

AES_GMAC implementation [closed]

I need to implement AES_GMAC encryption and decryption in c/c++ programming language. For the implementation, I have referred following document: ...
1
vote
1answer
185 views

Where is the authentication tag stored in file encrypted using AES-GCM?

So I am using cryptopp to encrypt a file in a project and I am using AES-GCM. I have a 256bit key and a 128bit ivec and a 128bit tag that I use to encrypt files. However, I want to know where the ...
1
vote
3answers
136 views

Salsa20-GCM composition secure?

AES-GCM seems to be used by everyone but I never seen even one post about Salsa20-GCM. Is it secure? Wikipedia mentions that GCM ...
2
votes
1answer
130 views

Security of integrity protection with HMAC vs AEAD

I'd like to know how the security of the integrity protection compares between: HMAC-SHA-256 with an 32 byte tag or a truncated 16 byte tag AES-GCM with a 16 byte tag AES-CCM with a 16 byte tag or ...
0
votes
1answer
84 views

GCM implementation

I want to write GCM implementation myself (only for research purposes). So far, I have successfully written CTR implementation (for AES), but now I ran into few problems with GCM. If I'm not wrong, ...
6
votes
2answers
2k views

AES GCM vs other encryption modes in embedded environment for network traffic

I'm doing a lot of research since I'm doing an internship for a company where I need to upgrade their security level. Their own protocol needs a cryptographic upgrade and I'm leaning towards AES since ...
0
votes
1answer
120 views

ECIES with AES-GCM

The Elliptic Curve Integrated Encryption Scheme (ECIES) describes how to derive a "temporal" key, encrypt a message (eg. using AES) and creating a MAC. However, from my understanding using AES in GCM ...
3
votes
1answer
131 views

Save the last cycle in GCM GHASH calculation

I need to implement GCM GHASH in hardware, using FPGA. The data bus is 640 bits, so I will use 5 adder/multiplier blocks in parallel. The message size is fixed and AAD is 0. A little example: ...
0
votes
1answer
99 views

Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit?

In reading through the original GCM specification (McGrew & Viega '05), the composition of the 128 bit Initialization Vector as a concatenation of a 96b nonce and a 32b unsigned wrapping counter ...
2
votes
1answer
65 views

Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit? [duplicate]

In reading through the original GCM specification (McGrew & Viega '05), the composition of the 128 bit Initialization Vector as a concatenation of a 96b nonce and a 32b unsigned wrapping counter ...
0
votes
1answer
72 views

Should the nonce passed to GCM be authenticated?

This answer recommends authenticating the IV with HMAC when using AES and then HMAC. Since AES-GCM provides authentication too, should the external nonce passed to GCM be authenticated separately ...
2
votes
2answers
512 views

Can AES in CCM or GCM counter mode interoperate with AES in “plain” counter mode (CTR)?

I am exploring the use of Windows CNG to replace some OpenSSL-based code that takes advantage of AES in counter mode. From the outside, everything should look the same after the switch. The section ...
2
votes
1answer
81 views

Post processing of AAD and len A||C in a hardware AES GCM implementation

I'm new to GCM and I need to implement it in hardware, using FPGA. The data bus is 640 bits, so I will use 5 adder/multiplier blocks in parallel. The message size and AAD size are constant. My design ...
2
votes
1answer
146 views

Is AES-GCM length extension attack possible using authenticated decryption?

I am looking to encrypt a piece of data using AES-GCM with a full 16-byte GCM Tag and send it over the network using UDP. Is it safe to assume using the AEAD nature of AES-GCM that performing ...
1
vote
1answer
693 views

Java: How to handle authenticated encryption for big files

First I need to mention that I can't use BouncyCastle to implement this solution. I have to encrypt files into the file system. Those files are not going to be tranfered over the wire to any other ...
4
votes
2answers
3k views

Encryption of big files in Java with AES/GCM

I have to encrypt big files. Say their size ranges from 500mb to several of gigabytes. I would like to use AES/GCM/NoPadding as provided by Java 1.8 since that gives me automatic authentication and ...
4
votes
1answer
173 views

GCM: Math behind update of AAD after ciphertext has been processed

In the Bouncy Castle libraries, the GCM cipher implementation has an interesting property that does not seem described in the GCM papers (neither the NIST or the original paper): Some AAD was sent ...
14
votes
2answers
2k views

AES-GCM Disadvantage

What is the disadvantage of AES-GCM mode for authenticated encryption? Why does the CAESAR competition say that it’s one of the goals to find an AE scheme that offers an advantage over AES-GCM? What ...
6
votes
1answer
791 views

Using GMAC for Authentication without encrypting the message

I am pretty new to cryptography and have a sample of GCM mode of operation for AES. PFB the code ...
4
votes
1answer
4k views

AES256-GCM - can someone explain how to use it securely (ruby)

I am looking into using AES256-GCM for encrypting some database fields. I know that for AES256-CBC, I need to generate a new IV for each encrypt, but I can use the same key. The IV can be openly ...
3
votes
1answer
856 views

Why does AES-GCM need a hash/MAC in TLS?

"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" is just one example for a cipher suite, as far as I'm concerned it means this: It uses the TLS protocol, exchanges keys with Elliptic Curve Diffie Hellman ...