# Tag Info

8

The answer is, yes, you can get FIPS certification even if you don't implement every approved cryptographical primitive, or if you don't implement every possible option of those primitives. When you undergo FIPS testing, they ask you to fill out an "information form" that asks for the details of what cryptography you claim to implement. These includes ...

7

The GCM authentication tag doesn't need to be encrypted. Just attach it to the ciphertext in the clear. A very quick intuitive justification: It's an authentication tag derived from the ciphertext, it doesn't contain any sensitive information itself. The security of the GCM model assumes the tag is left in the open. (The GCM spec, SP 800-38D, shows the ...

6

First of all, a terminology nit: please don't say "a One-time-pad generated by a CSPRNG"; a one-time pad must, by definition, be generated randomly, and an important part of its security proof is that it was generated randomly (and so an attacker cannot disqualify any potential pad, even if that attacker had infinite computational resources). ...

5

In the context of packet communications, it feels like it would be optimal to setup key and IV once and then use that single initialisation in some way for all packets on the same channel. It might be optimal for efficiency standpoint, but we also care about security; it isn't necessary very good for security. You mentioned that, with CBC mode, you can ...

5

It is indeed safe to send it along with the ciphertext; the attacker can't learn anything from it (other than possibly how many packets has been generated so far, if you use a counter to generate the IVs), and if the attacker modifies the IV, the resulting message will fail to decrypt (with high probability). Existing protocols that can use GCM (TLS, IPSec) ...

5

If you use a CSPRNG to generate the pad, you're not using a one-time-pad anymore by definition since the pad is no longer random, so the question as stated is incorrect with respect to terminology. The advantage of using stream ciphers is that you no longer have the key distribution problem the OTP has, since your key is now only a few dozen bits long, and ...

5

If you go through the math, it appears that exactly the expected amount of ciphertext expansion is happening. Here's what's happening: The GCM takes the plaintext as a byte string of size N, and generates a ciphertext which is a byte string of size N+28, where 12 of the 28 is the nonce, and the other 16 is the authentication tag. Then, that octet string ...

5

GCM mode already incorporates any params that could affect the outcome of the decryption. The associated authenticated data is there to allow you to rely on context for your decryption. For example, say you are encrypting some records associated with a user. You may want to include the user's database ID as the authenticated data. If a user found a way to ...

4

You got some notation wrong. There is no algorithm like "AES-GCM-SHA-256". AES is a block cipher, i.e. a pseudorandom permutation of 128-bit blocks. It itself only allows encryption for messages of size 128 bits (= 16 bytes), with a limited security guarantee. When you mean "encrypt the data using AES", you actually mean "use AES with some mode of ...

4

To answer your question: yes, GMAC does have niche applications where it performs better than either HMAC or CMAC; however it might not make sense for you. First of all, you are correct in that GMAC requires an IV, and bad things happen if a particular IV value is reused; this rather rules out GMAC for some applications, and is a cost even for applications ...

4

I currently manually append the "tag" property to the ciphertext, is this the correct method of authentication? That is a perfectly acceptable method. In the end, there needs to be some protocol which tells the other party where the ciphertext is and where the authentication tag is. In your case, the other party knows that the last 128 bits of the ...

4

eBACS, as given by CodesInChaos, is a great resource, and it provides much more data than I could hope to give in this answer. However, the page is not explicit about whether or not AES-NI was used — looking at the results, it doesn't seem so. For an extremely shallow analysis, but allowing us to know for-sure about hardware acceleration, we can use ...

3

In comparison against CBC mode and HMAC, GCM mode is quite commonly better alternative. But, I'll go to detail where it neccessarily is not. Just like Richie Frame, I also do not agree that CBC + HMAC is always the best comparison target. I've added few other details. Hope you find them useful. Against CBC and HMAC I'll discuss downsides first. The ...

3

I don't see any obvious way to do this without violating the security of GCM; at least, if you are at all concerned with an evesdropper (and if you're not, why are you encrypting at all?) Here is a distallation of your requirements: you want to have the sender send the ciphertext (including nonce, ciphertext and tag). Then, you want the sender to be able ...

3

You certainly could keep the AAD secret; however, for GCM, it wouldn't provide any additional security beyond what the secret key already provides; for CCM, it does still provide some limited authentication protection (but probably not enough). The bottom line: if you can't trust that your key is secret, well, keeping the AAD secret (or have a secret ...

3

Well, I'm unfamiliar with this specific C# library, and so I can't answer questions about its API. I could guess, but I suspect you want something better than that. However, I can answer generic GCM questions. 1a. What does the AAD consist of? Well, AAD is another service that GCM provides. When encrypting messages, it is actually quite common to want ...

2

Regarding GCM mode and the uniqueness of the nonce, it should be noted that EAX mode and OCB mode also require unique nonces. One potential problem EAX mode has, which neither GCM or CCM have, is that it is hard to implement it in such way that you can guarantee that the probability of nonce collisions is zero; only that it is acceptably low. OCB mode has ...

2

Here's a NodeJS AES-GCM module. Or alternatively, you can use the OpenSSL library to write your own GCM decryption code, here's a quick tutorial. The OpenSSL utility has historically not supported GCM encryption/decryption via command line parameters, likely due to the auth tag issue. I don't think that anything has changed since then, so you may want to ...

1

There exists a case where developers implemented a new version of the GHASH algorithm that used the new PCLMULQDQ instruction found in Intel processors, and a bug in the implementation allowed message forgery. The code change appeared to improve the performance of AES-GCM on newer processors as well as processors with additional cores that do not support ...

1

Your options should really be either using GCM mode, or using a non-authenticated mode (such as CBC) and calculating the HMAC (with something like HMAC-SHA256) post-encryption. Using an asymmetrical encryption scheme such as RSA in this context is not very efficient or appropriate. GCM is a good option as it combines encryption and integrity in one ...

1

It is not possible to get the same secret every time. You get a new random shared secret reach time. The protocol (for a known generator $g \in G$ where $G$ and $g$ are chosen correctly) is Alice computes $A=g^a$ and sends $A$ to Bob. $$Alice \ g^a\xrightarrow{A} Bob$$ Then Bob computes $B=A^b$ and sends it to Alice. $$Alice \xleftarrow{B} B=A^b\ Bob$$ ...

1

Yes, the nonce will be used with a counter appended in order to generate the CTR mode keystream. It will also be used as an input to GHASH: which is a polynomial MAC used to authenticate the data. The nonce itself does not have to be random, it can be a counter. But it absolutely must be unique for each message encrypted with the same key. Using GCM on two ...

1

It's much more secure to use AES (or some other well-understood cipher) in a well-described mode than to go construct some random number generator and pretend that it's a one-time pad. It's better not to lie to yourself. If you use AES in counter mode, you're effectively using AES as a PRNG and then that as a pad, since you XOR the AES onto the plaintext. ...

1

Thats a Pseudo-One-Time Pad. A good CSPRNG need have only one attribute. Its output must be unpredictable to an attacker. And thats it. If it is truly unpredictable, then it must be random (otherwise it could be predicted). Note that many PRNG are completely predictable - for some simple schemes given a few bytes of output, the rest can be 100% predicted. ...

Only top voted, non community-wiki answers of a minimum length are eligible