# Tag Info

27

AES-GCM has the following problems: In the case of nonce reuse both integrity and confidentiality properties are violated. If the same nonce is used twice, an adversary can create forged ciphertexts easily. When short tags are used, it is rather easy to produce message forgeries. For instance, if the tag is 32 bits, then after $2^{16}$ forgery attempts and ...

24

GCM and CBC modes internally work quite differently; they both involve a block cipher and an exclusive-or, but they use them in different ways. In CBC mode, you encrypt a block of data by taking the current plaintext block and exclusive-oring that wth the previous ciphertext block (or IV), and then sending the result of that through the block cipher; the ...

16

In comparison against CBC mode and HMAC, GCM mode is quite commonly better alternative. But, I'll go to detail where it neccessarily is not. Just like Richie Frame, I also do not agree that CBC + HMAC is always the best comparison target. I've added few other details. Hope you find them useful. Against CBC and HMAC I'll discuss downsides first. The ...

15

Contrary to what Stephen says, you absolutely can compute the tag in parallel. Here's how it works; the tag computation is essentially "assemble the AAD, data, the length field and $Encr(Nonce)$ into a series of values $x_n, x_{n-1}, x_{n-2}, ..., x_0$", and then "compute the polynomial $x_nh^n + x_{n-1}h^{n-1} + x_{n-2}h^{n-2} + ... + x_0h^0$ This ...

12

CCM (Counter with CBC-MAC) Message authentication (via CBC-MAC) is done on the plaintext not the ciphertext. (This is generally not a desireable feature.) On the encrypt operation, the encryption and MAC could happen in parallel, but generally do not (typically because there is just one AES engine in a chip, just one AES thread at a time, etc.). Similar ...

12

Before answering your questions: GCM is an authentication encryption mode of operation, it is composed by two separate functions: one for encryption (AES-CTR) and one for authentication (GMAC). It receives as input: a Key a unique IV Data to be processed only with authentication (associated data) Data to be processed by encryption and authentication It ...

11

In general the AAD itself is not required or won't change the security of the GCM mode of operation itself. It may however directly influence the security of the protocol in which GCM is deployed. For instance, you may have specific configurable parameters outside the ciphertext itself. These parameters may very well include: version number of the ...

10

The answer is, yes, you can get FIPS certification even if you don't implement every approved cryptographical primitive, or if you don't implement every possible option of those primitives. When you undergo FIPS testing, they ask you to fill out an "information form" that asks for the details of what cryptography you claim to implement. These includes ...

9

AES has a block-size of 128 bits in all its variants. The number in AES-128/192/256 is the key-size. Rijndael, the block-cipher that became AES, also supports 256 bit blocks, but that part was not standardized as AES. Since the block-size is 128 bits, GCM works exactly the same way for AES-256 as it does for AES-128.

8

eBACS, as given by CodesInChaos, is a great resource, and it provides much more data than I could hope to give in this answer. However, the page is not explicit about whether or not AES-NI was used — looking at the results, it doesn't seem so. For an extremely shallow analysis, but allowing us to know for-sure about hardware acceleration, we can use ...

8

The GCM authentication tag doesn't need to be encrypted. Just attach it to the ciphertext in the clear. A very quick intuitive justification: It's an authentication tag derived from the ciphertext, it doesn't contain any sensitive information itself. The security of the GCM model assumes the tag is left in the open. (The GCM spec, SP 800-38D, shows the ...

8

AEAD modes like GCM are authenticated encryption with associated data; this setting only affects the associated data half of that. The ciphertext itself is still authenticated. The associated data portion is there to provide contextual information for the authentication of the ciphertext. Usually this data is something that's outside of direct control of the ...

8

I'll answer in order: Output size = input size That's correct, GCM uses CTR internally. It encrypts a counter value for each block, but it only uses as many bits as required from the last block. CTR turns the block cipher into a stream cipher. IV of any size For GCM a 12 byte IV is strongly suggested as other IV lengths will require additional calculations....

8

AAD has nothing to do with making it "more secure". The aim of AAD is to attach information to the ciphertext that is not encrypted, but is bound to the ciphertext in the sense that it cannot be changed or separated. (Conceptually, the MAC is computed over the AAD and the ciphertext together.)

7

First of all, a terminology nit: please don't say "a One-time-pad generated by a CSPRNG"; a one-time pad must, by definition, be generated randomly, and an important part of its security proof is that it was generated randomly (and so an attacker cannot disqualify any potential pad, even if that attacker had infinite computational resources). Exclusive-or'...

7

If you go through the math, it appears that exactly the expected amount of ciphertext expansion is happening. Here's what's happening: The GCM takes the plaintext as a byte string of size N, and generates a ciphertext which is a byte string of size N+28, where 12 of the 28 is the nonce, and the other 16 is the authentication tag. Then, that octet string ...

7

AES-GCM uses single block cipher operation and can be processed in parallel, therefore it should be faster. CTR+HMAC requires block cipher and hash function, which usually can't be processed in parallel. Also it requires 2 keys. It is often miss-implemented (MAC-than-encrypt or MAC-and-encrypt, using single key). Cipher-text length is the same for same ...

7

This is terrible. In GCM, if you use the same nonce, then the authenticator is completely broken (for all messages in the future). You should never assume that the attacker doesn't know the filename either. You MUST use different IVs.

6

In the context of packet communications, it feels like it would be optimal to setup key and IV once and then use that single initialisation in some way for all packets on the same channel. It might be optimal for efficiency standpoint, but we also care about security; it isn't necessary very good for security. You mentioned that, with CBC mode, you can ...

6

You got some notation wrong. There is no algorithm like "AES-GCM-SHA-256". AES is a block cipher, i.e. a pseudorandom permutation of 128-bit blocks. It itself only allows encryption for messages of size 128 bits (= 16 bytes), with a limited security guarantee. When you mean "encrypt the data using AES", you actually mean "use AES with some mode of ...

6

Yes, the nonce will be used with a counter appended in order to generate the CTR mode keystream. It will also be used as an input to GHASH: which is a polynomial MAC used to authenticate the data. The nonce itself does not have to be random, it can be a counter. But it absolutely must be unique for each message encrypted with the same key. Using GCM on two ...

6

It is indeed safe to send it along with the ciphertext; the attacker can't learn anything from it (other than possibly how many packets has been generated so far, if you use a counter to generate the IVs), and if the attacker modifies the IV, the resulting message will fail to decrypt (with high probability). Existing protocols that can use GCM (TLS, IPSec) ...

6

From RFC 5246, section 6.2.3.3: AEAD Ciphers: AEAD ciphers take as input a single key, a nonce, a plaintext, and "additional data" to be included in the authentication check, as described in Section 2.1 of [AEAD]. The key is either the client_write_key or the server_write_key. No MAC key is used. However in RFC 5246, section 5: HMAC ...

6

Well, $\operatorname{GHASH}$ might be better understood as the polynomial: $$\operatorname{GHASH}_H(X_1, X_2, ... , X_{m-1}, X_m) = X_1 H^{m} + X_2 H^{m-1} + ... + X_{m-1} H^2 + X_m H^1$$ where addition, multiplication and exponentiation are in the field $GF(2^{128})$. These addition, multiplication and exponentiation operations act algebraically quite a ...

6

The source of the limitation lies in the fact that GCM has a fixed block counter using a 32-bit integer. Since the block size is $2^7$ bits, the total amount that can be encrypted with the CTR component is $2^{39}$ bits. The first limit reducing this by 128-bits is the fact that the block counter starts at 1 and not 0, at least with a 96-bit nonce. Nonce ...

5

If you use a CSPRNG to generate the pad, you're not using a one-time-pad anymore by definition since the pad is no longer random, so the question as stated is incorrect with respect to terminology. The advantage of using stream ciphers is that you no longer have the key distribution problem the OTP has, since your key is now only a few dozen bits long, and ...

5

GCM mode already incorporates any params that could affect the outcome of the decryption. The associated authenticated data is there to allow you to rely on context for your decryption. For example, say you are encrypting some records associated with a user. You may want to include the user's database ID as the authenticated data. If a user found a way to ...

5

Well, I'm unfamiliar with this specific C# library, and so I can't answer questions about its API. I could guess, but I suspect you want something better than that. However, I can answer generic GCM questions. 1a. What does the AAD consist of? Well, AAD is another service that GCM provides. When encrypting messages, it is actually quite common to want ...

5

To answer your question: yes, GMAC does have niche applications where it performs better than either HMAC or CMAC; however it might not make sense for you. First of all, you are correct in that GMAC requires an IV, and bad things happen if a particular IV value is reused; this rather rules out GMAC for some applications, and is a cost even for applications ...

5

I don't see any obvious way to do this without violating the security of GCM; at least, if you are at all concerned with an evesdropper (and if you're not, why are you encrypting at all?) Here is a distallation of your requirements: you want to have the sender send the ciphertext (including nonce, ciphertext and tag). Then, you want the sender to be able ...

Only top voted, non community-wiki answers of a minimum length are eligible