Questions tagged [gcm]

The Galois Counter Mode, an authenticated encryption mode of operation for a block cipher.

Filter by
Sorted by
Tagged with
25 votes
2 answers
22k views

How bad it is using the same IV twice with AES/GCM?

I understand that initialization vectors (IV) should not be used twice when using AES/GCM. I am using a counter as an initialization vector. Every time I send out a new packet (I am developing an UDP ...
Matteo Monti's user avatar
  • 1,407
44 votes
2 answers
36k views

AES-GCM recommended IV size: Why 12 bytes?

When using AES-GCM, a 96-bit IV is generally recommended. Most implementations I've seen also use 96-bit. However, I'm unsure on where this recommendation or convention comes from. Let's assume a ...
Hendrikvh's user avatar
  • 543
27 votes
3 answers
10k views

Plain text size limits for AES-GCM mode just 64GB?

Based on NIST SP 800-38D section 5.2.1.1, it seems that the maximum length of plaintext is 2^39-256 bits ~ 64 GB. We've got 100+GB files in genomics that need to be GCM encrypted so are concerned ...
DeepSpace101's user avatar
  • 1,697
22 votes
2 answers
4k views

Is (AES-)GCM parallelizable?

I recentely faced the issue of random access decryption while AES-GCM was being used. I said this person that the underlying CTR should allow parallelization but I have no idea how authentication ...
SEJPM's user avatar
  • 45.9k
3 votes
1 answer
1k views

Is it dangerous to encrypt lots of small files with the same key?

I want to encrypt 1000s of old files on old hard drives before uploading them to the cloud. I'm planning to use AES-GCM with only one or a few keys. (I'm using Apple's CryptoKit library which provides ...
Rob N's user avatar
  • 133
36 votes
2 answers
27k views

Practical disadvantages of GCM mode encryption

It seems that GCM mode encryption has a clear advantage over CBC + HMAC in the sense that it only requires a single key. But it seems that there are some experts here that do not trust it enough to ...
Maarten Bodewes's user avatar
  • 92.6k
33 votes
2 answers
8k views

Disadvantage AES-GCM

What are the disadvantages and weaknesses of AES-GCM mode for authenticated encryption? Why does the CAESAR competition say that it’s one of the goals to "find an AE scheme that offers an ...
user2035863's user avatar
7 votes
1 answer
950 views

How to securely encrypt/decrypt data with a maximum chunk size?

I am aware of the different modes so that a "raw" block cipher such as AES (ECB) can be used to encrypt more than a single block of data (CBC, OFB, CTR, etc) and modes such as AES-GCM which ...
user239146146's user avatar
9 votes
1 answer
7k views

Why does AES-GCM need a hash/MAC in TLS?

"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" is just one example for a cipher suite, as far as I'm concerned it means this: It uses the TLS protocol, exchanges keys with Elliptic Curve Diffie Hellman ...
hl3mukkel's user avatar
  • 499
9 votes
1 answer
3k views

Poly1305-AES vs AES-GCM

What are the advantages of Poly1305-AES over AES-GCM? Please note I am not talking about chacha20-Poly1305 that has been widely adopted, including by Google. But I would like to know pros and cons ...
user12480's user avatar
  • 273
47 votes
2 answers
52k views

How to choose between AES-CCM and AES-GCM for storage volume encryption

We are using the encryption built into Solaris 11 ZFS, which offers the choice between CCM (CBC counter mode) and GCM (Galois counter mode). What are the pros and cons of choosing each of these cipher ...
ruief's user avatar
  • 662
43 votes
1 answer
49k views

Ciphertext and tag size and IV transmission with AES in GCM mode

I am completely new to using AES in GCM mode of operation, and I have not a very large background in cryptography as well. I have been playing with OpenSSL trying to encrypt and decrypt some messages. ...
Matteo Monti's user avatar
  • 1,407
92 votes
2 answers
172k views

What is the difference between CBC and GCM mode?

I am trying to learn more about GCM mode and how it differs from CBC. I already know that GCM provides a MAC, which is used for message authentication. From what I have read and from the code snippets ...
Bob Bryan's user avatar
  • 1,283
11 votes
1 answer
654 views

how does BearSSL's GCM modular reduction work?

BearSSL (in src/hash/ghash_ctmul.c) seems to be doing a modular reduction that I don't completely understand. Here's the code: ...
neubert's user avatar
  • 2,927
10 votes
3 answers
15k views

Encryption of big files in Java with AES/GCM

I have to encrypt big files. Say their size ranges from 500mb to several of gigabytes. I would like to use AES/GCM/NoPadding as provided by Java 1.8 since that gives me automatic authentication and ...
alejo's user avatar
  • 127
9 votes
1 answer
2k views

What are the constraints on using GCM with a tag size of 96 and 128 bits?

Say we want to use AES (or any other secure 128 bit block cipher) with GCM and a tag size of 96 or 128 bits. I'm assuming an AES key size of 128 bits and an IV size of 96 bits (the default). NIST SP ...
Maarten Bodewes's user avatar
  • 92.6k
8 votes
1 answer
5k views

Relationship between AES GCM and AES CTR

I have read that AES GCM uses AES CTR for encryption and GMAC for authentication. If that is correct, what is the relationship between the IV used for AES GCM and the IV used for AES CTR? TO put the ...
Tricky Dixon's user avatar
7 votes
1 answer
3k views

Has GMAC mode a future outside GCM?

Once gcm has been implemented for providing both encryption & authentication solution , it appears obvious to consider that such implementation can also provide (if required by new user) a Mac ...
william_fr's user avatar
7 votes
2 answers
18k views

Is the Java function AES/CBC/PKCS5Padding vulnerable to padding oracle?

I have an application that stores data on the devices. Currently AES/CBC/PKCS5Padding from javax.crypto.Cipher(see reference) is ...
GarlicCheese's user avatar
6 votes
1 answer
682 views

Security of GCM if Implemented with Stream Cipher instead of Block Cipher

Can GCM be implemented with a stream cipher instead of a block cipher? If no, then what security flaw does it have? If yes, then which possibility from below two is better in terms of security? In ...
crypt's user avatar
  • 2,407
18 votes
1 answer
12k views

GCM vs CTR+HMAC tradeoffs

So these days I see everyone using AES-GCM. What are its advantages over simple CTR+HMAC modes? Is it speed? Or ciphertext length? And what are the security tradeoffs, both in terms of practical ...
Samee's user avatar
  • 281
13 votes
2 answers
24k views

Where is the authentication tag stored in file encrypted using AES-GCM?

So I am using cryptopp to encrypt a file in a project and I am using AES-GCM. I have a 256bit key and a 128bit ivec and a 128bit tag that I use to encrypt files. However, I want to know where the ...
Mo Beigi's user avatar
  • 245
7 votes
1 answer
5k views

Safety of random nonce with AES-GCM?

I am encrypting multiple messages using a 256 bit key with AES in GCM mode, generating a random 96 bit nonce for each message. The small nonce size combined with random values is worrying me: AES-...
aes_gcm's user avatar
  • 71
7 votes
2 answers
2k views

Is it possible to tweak AES-GCM so that it is satisfactory for whole-disk encryption (like XTS mode)?

Is it possible to leverage a preexisting implementation of AES-GCM to provide the key security benefits essential for full-disk encryption (similar to AES-XTS)? GCM is a popular encryption mode ...
user3325588's user avatar
6 votes
1 answer
3k views

Security of authenticated encryption modes GCM & CCM

I have two questions for Clarification for AE mode choice criteria GCM : it appears to be actually the most popular and widely used AE mode of operation. however it is also well-known to be highly ...
william_fr's user avatar
5 votes
1 answer
515 views

GCM: Math behind update of AAD after ciphertext has been processed

In the Bouncy Castle libraries, the GCM cipher implementation has an interesting property that does not seem described in the GCM papers (neither the NIST or the original paper): Some AAD was sent ...
Maarten Bodewes's user avatar
  • 92.6k
4 votes
2 answers
607 views

Generate $J_0$ for GCM cipher when $\operatorname{len}(IV) \neq 96$ bits

I have the following questions about the construction of J0 when is not equal to 96 bits, $s= 128\big\lceil \operatorname{len}(\text{IV})/128\big\rceil-\operatorname{len}(\text{IV})$ For example if ...
user3127939's user avatar
4 votes
2 answers
2k views

GCM encryption for 256-bit and 512-bit block ciphers

The Galois/Counter Mode of Operation (GCM) This paper describe using GCM mode with 128-bit and 64-bit block cipher. Can we use this mode for 256-bit and 512-bit block cipher?
NiceTheo's user avatar
  • 591
2 votes
2 answers
2k views

Does AES-GCM without security tag turn into regular CTR Mode?

We are looking to implement a simple password based key agreement scheme. Part of this is deriving a symmetric key from a common passphrase known to both parties involved. This symmetric key is then ...
MSDNE's user avatar
  • 23
2 votes
1 answer
6k views

AES-GCM cipher - Nonce vs IV

I am using a Python library called PyCryptodome, which offers the following API for AES-GCM ciphers: https://pycryptodome.readthedocs.io/en/latest/src/cipher/aes.html As you see, IV is not ...
Aemilius's user avatar
  • 123
2 votes
2 answers
2k views

Which is slower, AES or GCM hash (GHASH), if CPU has no special instructions?

In an answer to this question: Security of GCM if Implemented with Stream Cipher instead of Block Cipher ...it was stated that: The GHASH part of GCM is usually the problematic one when it comes to ...
juhist's user avatar
  • 1,247
1 vote
1 answer
666 views

Execution speed of AES_128 GMAC operation

I have read about the speed performance of AES_128_GCM on specific processors Intel and AMD that support AES New Instruction set. As compared with CMAC and HMAC is it relatively slow for other ...
hab's user avatar
  • 265
13 votes
1 answer
5k views

Does the GCM authentication tag need to be protected?

I am just learning about the GCM mode of AES and I'd like to start using it in my software. However, I have a question about its use. As I understand it the output of a GCM encryption operation is ...
Isaac's user avatar
  • 133
12 votes
1 answer
9k views

What is a safe maximum message size limit when encrypting files to disk with AES-GCM before the need to re-generate the key or NONCE

The general limits from the NIST recommendation are as follows: Maximum Encrypted Plaintext Size ≤ 239 - 256 bits; Maximum Processed Additional Authenticated Data ≤ 264 - 1 bits; This stack ...
Stan Ivanov's user avatar
10 votes
1 answer
2k views

How was the GCM polynomial found?

As far as I understand, there is no general way to enumerate irreducible polynomials in a particular finite field, which are similar in nature to prime numbers over the integers. The GCM mode finite ...
conchild's user avatar
  • 675
9 votes
3 answers
3k views

Can a zero nonce be safely used with AES-GCM if the key is random and never used again?

I could generate a random nonce and prepend it to the ciphertext, but storage space is at a premium and the only constraint AES-GCM has on the nonce (if I'm reading correctly) is that the same nonce ...
jnm2's user avatar
  • 582
8 votes
1 answer
693 views

Detection of weak keys for AES-GCM

There are many papers out there that show that a message authenticated and encrypted by AES-GCM can be forged if the used key is weak (e.g. by Handschuh and Preneel, Saarinen or Procter and Cid). With ...
budderick's user avatar
  • 425
7 votes
2 answers
5k views

Should I use XTS or GCM to encrypt my hard drives?

I want to start encrypting all of my hard drives, but I don't know whether to choose XTS or GCM mode. Why is it that XTS is recommended (since the most websites I visit use GCM in their HTTPS ...
blacklight's user avatar
7 votes
1 answer
652 views

How to communicate authentication tag for GCM?

I have written some code to do AES in GCM. I currently manually append the tag property to the ciphertext, is this the proper way to communicate the authentication tag?
crawfish's user avatar
  • 483
6 votes
1 answer
2k views

Useful additional data to employ in GCM

Are there any requirements for the additional data to be used in the GCM block cipher mode? And are there any "classic" used informations worthwile to be used? Can for example a username or the name ...
M-elman's user avatar
  • 1,248
6 votes
1 answer
503 views

Do Carter–Wegman MACs allow key reuse if the MAC tag is kept secret?

Poly1305 (and GHASH) are secure authenticators, but only for one use. Thus, nonce reuse in Poly1305-AES, ChaCha20-Poly1305, and AES-GCM all reveal the authentication key. However, my understanding ...
Demi's user avatar
  • 4,793
6 votes
2 answers
2k views

Security of encrypting many short values with AES in GCM mode

We intend to encrypt certain values in a database which holds personal information such as addresses so as to prevent data leakage should the database be compromised. The intention is that each field ...
Paul Smith's user avatar
6 votes
2 answers
6k views

Using GMAC for Authentication without encrypting the message

I am pretty new to cryptography and have a sample of GCM mode of operation for AES. PFB the code ...
Manu's user avatar
  • 165
5 votes
1 answer
283 views

Line by line encrypted logging stored with iv/salt/iterations. How safe is it?

I'm building an encrypted logging application. Log entries are encrypted with AES-256-GCM, using password-derived keys with PBKDF2. The application must support log rotation, and I would like to make ...
aspyct's user avatar
  • 183
5 votes
0 answers
559 views

Is AES-GCM-SIV with fixed IV deterministic authenticated encryption?

Is there any functional or strong security difference beyond speed between AES-GCM-SIV with implicit fixed public IV and no additional data AES-CTR (or AES-OFB) with 128-bit IV computed per HMAC-SHA-...
fgrieu's user avatar
  • 141k
5 votes
1 answer
2k views

Security for IV in AES-GCM mode

I'd like to use AES-GCM instead of HMAC for authentication and privacy in a token used in a web application, but I'm unsure how to securely tag each token with an IV. Is it safe for me to prepend the ...
slipheed's user avatar
  • 427
5 votes
3 answers
1k views

Nonce-misuse-resistance scheme applied after the fact to AES-GCM for defense in depth?

This is a follow-up to a previous question about encrypting IV/MAC results from AEAD ciphers. I have a system I'm working on that needs to use standard (NIST/FIPS) cryptography, at least for its ...
Adam Ierymenko's user avatar
5 votes
1 answer
789 views

AEAD (for AES128-GCM): is it necessary to add a zero-length AAD?

In an implementation of AEAD_AES_128_GCM, if the AAD is defined as a "zero-length octet sequence", is it necessary to call the encryption code that adds an AAD at all? In particular, does an ...
slimhazard's user avatar
4 votes
1 answer
584 views

Is GCM with zero-length AAD less secure?

In a previous question, it was made clear that in the case of GCM, there is no distinction between "no AAD" and "zero-length AAD". Since I have noticed "zero-length AAD" ...
hlayhel's user avatar
  • 376
4 votes
1 answer
345 views

Is a stream cipher and a (cryptographically secure) PRNG nearly the same thing?

If I let the authentification tag aside (which is important), encrypting with AES-GCM and a fixed key and nonce: ...
Basj's user avatar
  • 553