# Tag Info

1

Because it does not make sense to create ciphers without any advantage over AES-GCM. I don't see any specific mention of disadvantages of AES-GCM in the call for submissions, nor do I see a requirement that the candidate has to have just one specific advantage over AES-GCM. And I guess you need some kind of marker to discuss features. I also guess that if ...

10

AES-GCM has the following problems: In the case of nonce reuse both integrity and confidentiality properties are violated. If the same nonce is used twice, an adversary can create forged ciphertexts easily. When short tags are used, it is rather easy to produce message forgeries. For instance, if the tag is 32 bits, then after $2^{16}$ forgery attempts and ...

5

I suppose one of the problems (they mention several after a short reading) with a mode like GCM is nonce misuse (e.g. reuse). When the key is the same and the nonce is reused, by misunderstanding the concept or by a simple programming error, information about the plain texts can be revealed. Phillip Rogaway has already defined an encryption mode (SIV, ...

Top 50 recent answers are included