Tag Info

0

So, I have to encrypt plaintext data to get ciphertext data and append authentication tag lets say at the end of the ciphertext data? That is correct, the auth tag is generally appended to the ciphertext. The Nonce component of the counter is also required. I would like to know now, what is the Auth Data and H "Auth Data" is additional data that ...

1

If you are constrained by the embedded environment, you should consider CCM instead of GCM as AES mode. One of the major constrain when implementing GCM is that the authentication part (the GHASH) is totally unrelated to AES and should be implemented in its own way. And, to make it reasonably fast, you have to use key-depended look up tables which will ...

1

GCM is a stream cipher -- it encrypts using CTR mode, which turns a block cipher primitive into a stream cipher. Additionally, GCM is an AEAD mode, which means the authentication is nicely built in (so you don't have to worry about how to handle it, because the mode itself specifies how to do it in a secure way). The IV does not need to be secret. However, ...

0

It's perfectly safe; GCM provides both the confidentially and integrity guarantees that ECIES requires. Just a few notes: It doesn't matter what nonce you use; in fact, you can shrink the ciphertext a few bytes by making it implicit (as you'll use this GCM key only once) The AAD information you give GCM can either be empty, or optionally include a shared ...

2

Well, the GCM tag can be rearranged as $Tag = (Len(C, A) \times H) \oplus \textit{Other Stuff}$; if the length of your ciphertext (and additional authentication data) is consistent, you could precompute $Len(C, A) \times H$, and xor that in along with everything else in the final step. One note: the (add/multiply) that you do in cycle 6 has the side effect ...

Top 50 recent answers are included