Questions tagged [gcm]
The Galois Counter Mode, an authenticated encryption mode of operation for a block cipher.
28
questions with no upvoted or accepted answers
12
votes
0
answers
2k
views
Why does the Signal protocol use AES/CBC instead of AES/GCM?
AES/GCM has obviously proved itself to be better than AES/CBC. Unless the key is re-used with the same initialization vector (see disadvantages of GCM). More information on its advantages against CBC ...
9
votes
0
answers
248
views
GCM with reversed poly
These slides talk about how GCM can be sped up if one uses $x^{128}+x^{127}+x^{126}+x^{121}+1$ as the reduction polynomial instead of $x^{128}+x^7+x^2+x^1+1$.
When one is doing that one needs to ...
7
votes
0
answers
381
views
Are there any test vectors for the CMS content type AuthEnvelopedData (for AES-GCM)?
I am looking for CMS AuthEnvelopedData test vectors for AES-GCM mode. I haven’t seen any ready-to-use test vectors for it. There are test vectors for AES-GCM mode but not for its CMS support.
I even ...
5
votes
0
answers
559
views
Is AES-GCM-SIV with fixed IV deterministic authenticated encryption?
Is there any functional or strong security difference beyond speed between
AES-GCM-SIV with implicit fixed public IV and no additional data
AES-CTR (or AES-OFB) with 128-bit IV computed per HMAC-SHA-...
3
votes
1
answer
140
views
High volume encryption with AES-GCM: AWS KMS vs CloudHSM
In my current project we will have to encrypt a lot of S3 objects (a few billions) with AWS KMS.
Our security department requires that we use KMS keys backed by CloudHSM. But since CloudHSM incurs ...
3
votes
0
answers
267
views
How to break GCM that uses the same IV
I have an implementation that natively uses the same IV (12 bytes of 0) for all encryption. The key is always a 32 byte SHA-512 hash. I know via this post that I ...
3
votes
0
answers
66
views
Can GCM auth be bitsliced?
Is it possible to use bitslicing for GCM? This seems like a way to allow for a way to avoid cache-timing attacks without PCLMUL instructions and with good performance.
2
votes
0
answers
71
views
Secure option for (hybrid) encryption of a secret key using JWE
I want to encrypt a private key $sk$ (it's actually an RSA private key in PKCS#8 format) with another person's (and/or my) public key $pk_A$ for secure storage. With JWE, it is possible to use hybrid ...
2
votes
0
answers
33
views
Does the size of data to be encrypted influence the security of Gmac?
In this link: Has GMAC mode a future outside GCM?, the last comment given by the user Demi, indicates that the larger the size of the text to be encrypted, the lower the security of the gmac.
Why is ...
2
votes
0
answers
258
views
Conforming to best practices in password file (keyring) encryption
In order to implement a plaintext password file safe (keyring), while adhering to best Crypto practices today, I came up with this scheme:
A user's master password is hashed with Argon2 (\$argon2id\$...
2
votes
0
answers
529
views
Is OCB the state of the art in authenticated encryption modes of operation for block ciphers?
OCB mode seems to represent the state of the art in authenticated encryption modes, largely due to its speed – it is faster than GCM even when GCM has hardware support. Its only drawbacks seem ...
2
votes
0
answers
398
views
Defending hybrid encryption schemes against padding oracle attacks
I intend to use a generic integrated/hybrid encryption scheme for transmitting information between a client and a server.
Key encapsulation: a 128-bit symmetric key is generated and asymmetrically ...
1
vote
0
answers
850
views
How can I decrypt AES-256 GCM with key with a IV that is missing?
I want to decrypt a file that has been encrypted using AES-256 in GCM mode in libressl. I have the key but I don't have the IV, is there any way I can still decrypt?
1
vote
1
answer
181
views
GCM Create M tables and R
I am trying to optimize GCM multiplication. This PDF explains GCM:
The Galois/Counter Mode of Operation (GCM)
The algorithms are in section 4.1
In algorithm 3 I have to multiply table M [128] ...
1
vote
0
answers
483
views
AES-GCM - what are "Payload Length" and "AAD Length"
For the AES-GCM mode within many cryptomodules, their FIPS-validation certificates list the options:
Payload Length: 504, 512, 1016, 1024
AAD Length: 0, 504, 512, 1016, 1024
For example in OpenSSL, "...
1
vote
0
answers
64
views
Authenticating a range of a ciphertext
I have some data that I CTR-AES-256 encrypt already. I am aware of ways to validate the integrity of the entire file (ie: a separate MAC of the plaintext, or encrypt then MAC, etc). But none of ...
1
vote
0
answers
291
views
AES-GCM Hash sub key parameter in Intel's IPsec library
I am trying to use Intel's optimized AES-128-GCM implementation (from the Intel white paper “Fast Multi-buffer IPsec Implementations on Intel Architecture Processors”, you can find the code here).
...
0
votes
0
answers
151
views
AES-GCM with a fixed IV but a random "wrapped" key
It is well-known that AES-GCM requires the IV to be unique for each message that is encrypted with the same key. If the IV ever repeats, with the same key, then AES-GCM fails catastrophically. Now, ...
0
votes
0
answers
85
views
Is it possible to uncover the plaintext if IV is used twice but the key is different?
I am currently working on a cryptography challenge. The program uses AES-GCM to encrypt and decrypt strings.
Let's say I have the following:
IV which is reused
only 1 cipher text
authentication tag
...
0
votes
0
answers
46
views
Encrypted Alert21- Error code 214
I am working on TLS 1.2 Cipher TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, After send the application data server throws an error message ...
0
votes
0
answers
713
views
Where to get AES GCM NIST-like test cases
I'm implementing AES GCM 256 bit at the moment. Now I'm finished with copying the content of the standard as a program and now have to make it actually work. With the test cases in the official NIST ...
0
votes
0
answers
157
views
Is this a reasonable design for encrypting records in a key/value database?
A while back I designed a protocol for en encrypted key/value service. My main goal was to minimize the value of a breached database by using cryptographic algorithms where a brute-force cracking ...
0
votes
0
answers
31
views
Authenticating and encrypting data for an automated system
I wish to distribute a file from A to an automated system B.
The requirements are:
Contents are encrypted
Contents are tamper proof
Contents origin is verified
To do this I have devised the ...
0
votes
0
answers
217
views
Can I use aes-gcm to authenticate a user based on his ability to decrypt a payload?
I'd like to authenticate my users without storing their password, even in a derived form with scrypt/pbkdf or other derivation methods.
I'm exploring the idea of encrypting a random payload with AES ...
0
votes
0
answers
280
views
Generating the Backup Exec AES-256 GCM key used to encrypt/decrypt LTO5 tape drive data
I've got an LTO5 tape that was backed up using Backup Exec (BE), which used hardware compression when writing to the tape. I've been given the passphrase that BE used to create the actual encryption ...
0
votes
0
answers
599
views
Can I Achieve Deterministic Encryption Using AES-GCM with Nonce = HMAC [ message ]
I would like to implement a deterministic encryption scheme within .NET. From the following post it is established using AES-SIV mode is appropriate. As AES-SIV mode is not implemented within the ...
0
votes
0
answers
132
views
Using OpenSSL to emulate LTO 4 tape encryption
I have a mix of LTO 4 and LTO 3 tapes I would like to encrypt data on to. LTO 4 has built in encryption - load they key into the drive, and it handles the AES-256-GCM encyption transparently. LTO 3 ...
0
votes
0
answers
191
views
Is there a reduction of security if I XOR Pkcs5S2 and SecureRandom?
I'm using this codereview sample to encrypt data. I would like to provide hardware protected encryption and a user password as the key.
Is it acceptable to XOR the KDF Pkcs5S2 in Bouncy Castle with a ...