Questions tagged [gcm]
The Galois Counter Mode, an authenticated encryption mode of operation for a block cipher.
66
questions
25
votes
2
answers
22k
views
How bad it is using the same IV twice with AES/GCM?
I understand that initialization vectors (IV) should not be used twice when using AES/GCM. I am using a counter as an initialization vector. Every time I send out a new packet (I am developing an UDP ...
44
votes
2
answers
36k
views
AES-GCM recommended IV size: Why 12 bytes?
When using AES-GCM, a 96-bit IV is generally recommended. Most implementations I've seen also use 96-bit. However, I'm unsure on where this recommendation or convention comes from.
Let's assume a ...
27
votes
3
answers
10k
views
Plain text size limits for AES-GCM mode just 64GB?
Based on NIST SP 800-38D section 5.2.1.1, it seems that the maximum length of plaintext is 2^39-256 bits ~ 64 GB.
We've got 100+GB files in genomics that need to be GCM encrypted so are concerned ...
22
votes
2
answers
4k
views
Is (AES-)GCM parallelizable?
I recentely faced the issue of random access decryption while AES-GCM was being used. I said this person that the underlying CTR should allow parallelization but I have no idea how authentication ...
3
votes
1
answer
1k
views
Is it dangerous to encrypt lots of small files with the same key?
I want to encrypt 1000s of old files on old hard drives before uploading them to the cloud. I'm planning to use AES-GCM with only one or a few keys. (I'm using Apple's CryptoKit library which provides ...
36
votes
2
answers
27k
views
Practical disadvantages of GCM mode encryption
It seems that GCM mode encryption has a clear advantage over CBC + HMAC in the sense that it only requires a single key. But it seems that there are some experts here that do not trust it enough to ...
33
votes
2
answers
8k
views
Disadvantage AES-GCM
What are the disadvantages and weaknesses of AES-GCM mode for authenticated encryption?
Why does the CAESAR competition say that it’s one of the goals to "find an AE scheme that offers an ...
7
votes
1
answer
950
views
How to securely encrypt/decrypt data with a maximum chunk size?
I am aware of the different modes so that a "raw" block cipher such as AES (ECB) can be used to encrypt more than a single block of data (CBC, OFB, CTR, etc) and modes such as AES-GCM which ...
9
votes
1
answer
7k
views
Why does AES-GCM need a hash/MAC in TLS?
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" is just one example for a cipher suite, as far as I'm concerned it means this:
It uses the TLS protocol, exchanges keys with Elliptic Curve Diffie Hellman ...
9
votes
1
answer
3k
views
Poly1305-AES vs AES-GCM
What are the advantages of Poly1305-AES over AES-GCM? Please note I am not talking about chacha20-Poly1305 that has been widely adopted, including by Google. But I would like to know pros and cons ...
47
votes
2
answers
52k
views
How to choose between AES-CCM and AES-GCM for storage volume encryption
We are using the encryption built into Solaris 11 ZFS, which offers the choice between CCM (CBC counter mode) and GCM (Galois counter mode). What are the pros and cons of choosing each of these cipher ...
43
votes
1
answer
49k
views
Ciphertext and tag size and IV transmission with AES in GCM mode
I am completely new to using AES in GCM mode of operation, and I have not a very large background in cryptography as well. I have been playing with OpenSSL trying to encrypt and decrypt some messages. ...
92
votes
2
answers
172k
views
What is the difference between CBC and GCM mode?
I am trying to learn more about GCM mode and how it differs from CBC. I already know that GCM provides a MAC, which is used for message authentication. From what I have read and from the code snippets ...
11
votes
1
answer
654
views
how does BearSSL's GCM modular reduction work?
BearSSL (in src/hash/ghash_ctmul.c) seems to be doing a modular reduction that I don't completely understand. Here's the code:
...
10
votes
3
answers
15k
views
Encryption of big files in Java with AES/GCM
I have to encrypt big files. Say their size ranges from 500mb to several of gigabytes.
I would like to use AES/GCM/NoPadding as provided by Java 1.8 since that gives me automatic authentication and ...
9
votes
1
answer
2k
views
What are the constraints on using GCM with a tag size of 96 and 128 bits?
Say we want to use AES (or any other secure 128 bit block cipher) with GCM and a tag size of 96 or 128 bits. I'm assuming an AES key size of 128 bits and an IV size of 96 bits (the default).
NIST SP ...
8
votes
1
answer
5k
views
Relationship between AES GCM and AES CTR
I have read that AES GCM uses AES CTR for encryption and GMAC for authentication.
If that is correct, what is the relationship between the IV used for AES GCM and the IV used for AES CTR?
TO put the ...
7
votes
1
answer
3k
views
Has GMAC mode a future outside GCM?
Once gcm has been implemented for providing both encryption & authentication solution , it appears obvious to consider that such implementation can also provide (if required by new user) a Mac ...
7
votes
2
answers
18k
views
Is the Java function AES/CBC/PKCS5Padding vulnerable to padding oracle?
I have an application that stores data on the devices. Currently AES/CBC/PKCS5Padding from javax.crypto.Cipher(see reference) is ...
6
votes
1
answer
682
views
Security of GCM if Implemented with Stream Cipher instead of Block Cipher
Can GCM be implemented with a stream cipher instead of a block cipher? If no, then what security flaw does it have?
If yes, then which possibility from below two is better in terms of security? In ...
18
votes
1
answer
12k
views
GCM vs CTR+HMAC tradeoffs
So these days I see everyone using AES-GCM. What are its advantages over simple CTR+HMAC modes? Is it speed? Or ciphertext length? And what are the security tradeoffs, both in terms of practical ...
13
votes
2
answers
24k
views
Where is the authentication tag stored in file encrypted using AES-GCM?
So I am using cryptopp to encrypt a file in a project and I am using AES-GCM.
I have a 256bit key and a 128bit ivec and a 128bit tag that I use to encrypt files.
However, I want to know where the ...
7
votes
1
answer
5k
views
Safety of random nonce with AES-GCM?
I am encrypting multiple messages using a 256 bit key with AES in GCM mode, generating a random 96 bit nonce for each message.
The small nonce size combined with random values is worrying me:
AES-...
7
votes
2
answers
2k
views
Is it possible to tweak AES-GCM so that it is satisfactory for whole-disk encryption (like XTS mode)?
Is it possible to leverage a preexisting implementation of AES-GCM to provide the key security benefits essential for full-disk encryption (similar to AES-XTS)?
GCM is a popular encryption mode ...
6
votes
1
answer
3k
views
Security of authenticated encryption modes GCM & CCM
I have two questions for Clarification for AE mode choice criteria
GCM : it appears to be actually the most popular and widely used AE mode of operation. however it is also well-known to be highly ...
5
votes
1
answer
515
views
GCM: Math behind update of AAD after ciphertext has been processed
In the Bouncy Castle libraries, the GCM cipher implementation has an interesting property that does not seem described in the GCM papers (neither the NIST or the original paper):
Some AAD was sent ...
4
votes
2
answers
607
views
Generate $J_0$ for GCM cipher when $\operatorname{len}(IV) \neq 96$ bits
I have the following questions about the construction of J0 when is not equal to 96 bits, $s= 128\big\lceil \operatorname{len}(\text{IV})/128\big\rceil-\operatorname{len}(\text{IV})$
For example if ...
4
votes
2
answers
2k
views
GCM encryption for 256-bit and 512-bit block ciphers
The Galois/Counter Mode of Operation (GCM)
This paper describe using GCM mode with 128-bit and 64-bit block cipher. Can we use this mode for 256-bit and 512-bit block cipher?
2
votes
2
answers
2k
views
Does AES-GCM without security tag turn into regular CTR Mode?
We are looking to implement a simple password based key agreement scheme. Part of this is deriving a symmetric key from a common passphrase known to both parties involved.
This symmetric key is then ...
2
votes
1
answer
6k
views
AES-GCM cipher - Nonce vs IV
I am using a Python library called PyCryptodome, which offers the following API for AES-GCM ciphers:
https://pycryptodome.readthedocs.io/en/latest/src/cipher/aes.html
As you see, IV is not ...
2
votes
2
answers
2k
views
Which is slower, AES or GCM hash (GHASH), if CPU has no special instructions?
In an answer to this question: Security of GCM if Implemented with Stream Cipher instead of Block Cipher ...it was stated that:
The GHASH part of GCM is usually the problematic one when it comes to ...
1
vote
1
answer
666
views
Execution speed of AES_128 GMAC operation
I have read about the speed performance of AES_128_GCM on specific processors Intel and AMD that support AES New Instruction set. As compared with CMAC and HMAC is it relatively slow for other ...
13
votes
1
answer
5k
views
Does the GCM authentication tag need to be protected?
I am just learning about the GCM mode of AES and I'd like to start using it in my software. However, I have a question about its use. As I understand it the output of a GCM encryption operation is ...
12
votes
1
answer
9k
views
What is a safe maximum message size limit when encrypting files to disk with AES-GCM before the need to re-generate the key or NONCE
The general limits from the NIST recommendation are as follows:
Maximum Encrypted Plaintext Size ≤ 239 - 256 bits;
Maximum Processed Additional Authenticated Data ≤ 264 - 1 bits;
This stack ...
10
votes
1
answer
2k
views
How was the GCM polynomial found?
As far as I understand, there is no general way to enumerate irreducible polynomials in a particular finite field, which are similar in nature to prime numbers over the integers.
The GCM mode finite ...
9
votes
3
answers
3k
views
Can a zero nonce be safely used with AES-GCM if the key is random and never used again?
I could generate a random nonce and prepend it to the ciphertext, but storage space is at a premium and the only constraint AES-GCM has on the nonce (if I'm reading correctly) is that the same nonce ...
8
votes
1
answer
693
views
Detection of weak keys for AES-GCM
There are many papers out there that show that a message authenticated and encrypted by AES-GCM can be forged if the used key is weak (e.g. by Handschuh and Preneel, Saarinen or Procter and Cid). With ...
7
votes
2
answers
5k
views
Should I use XTS or GCM to encrypt my hard drives?
I want to start encrypting all of my hard drives, but I don't know whether to choose XTS or GCM mode. Why is it that XTS is recommended (since the most websites I visit use GCM in their HTTPS ...
7
votes
1
answer
652
views
How to communicate authentication tag for GCM?
I have written some code to do AES in GCM. I currently manually append the tag property to the ciphertext, is this the proper way to communicate the authentication tag?
6
votes
1
answer
2k
views
Useful additional data to employ in GCM
Are there any requirements for the additional data to be used in the GCM block cipher mode?
And are there any "classic" used informations worthwile to be used? Can for example a username or the name ...
6
votes
1
answer
503
views
Do Carter–Wegman MACs allow key reuse if the MAC tag is kept secret?
Poly1305 (and GHASH) are secure authenticators, but only for one use. Thus, nonce reuse in Poly1305-AES, ChaCha20-Poly1305, and AES-GCM all reveal the authentication key. However, my understanding ...
6
votes
2
answers
2k
views
Security of encrypting many short values with AES in GCM mode
We intend to encrypt certain values in a database which holds personal information such as addresses so as to prevent data leakage should the database be compromised.
The intention is that each field ...
6
votes
2
answers
6k
views
Using GMAC for Authentication without encrypting the message
I am pretty new to cryptography and have a sample of GCM mode of operation for AES.
PFB the code
...
5
votes
1
answer
283
views
Line by line encrypted logging stored with iv/salt/iterations. How safe is it?
I'm building an encrypted logging application. Log entries are encrypted with AES-256-GCM, using password-derived keys with PBKDF2.
The application must support log rotation, and I would like to make ...
5
votes
0
answers
559
views
Is AES-GCM-SIV with fixed IV deterministic authenticated encryption?
Is there any functional or strong security difference beyond speed between
AES-GCM-SIV with implicit fixed public IV and no additional data
AES-CTR (or AES-OFB) with 128-bit IV computed per HMAC-SHA-...
5
votes
1
answer
2k
views
Security for IV in AES-GCM mode
I'd like to use AES-GCM instead of HMAC for authentication and privacy in a token used in a web application, but I'm unsure how to securely tag each token with an IV. Is it safe for me to prepend the ...
5
votes
3
answers
1k
views
Nonce-misuse-resistance scheme applied after the fact to AES-GCM for defense in depth?
This is a follow-up to a previous question about encrypting IV/MAC results from AEAD ciphers.
I have a system I'm working on that needs to use standard (NIST/FIPS) cryptography, at least for its ...
5
votes
1
answer
789
views
AEAD (for AES128-GCM): is it necessary to add a zero-length AAD?
In an implementation of AEAD_AES_128_GCM, if the AAD is defined as a "zero-length octet sequence", is it necessary to call the encryption code that adds an AAD at all? In particular, does an ...
4
votes
1
answer
584
views
Is GCM with zero-length AAD less secure?
In a previous question, it was made clear that in the case of GCM, there is no distinction between "no AAD" and "zero-length AAD". Since I have noticed "zero-length AAD" ...
4
votes
1
answer
345
views
Is a stream cipher and a (cryptographically secure) PRNG nearly the same thing?
If I let the authentification tag aside (which is important), encrypting with AES-GCM and a fixed key and nonce:
...