Reputation
Top tag
Next privilege 125 Rep.
Vote down
Badges
2
Newest
 Student
Impact
~92 people reached

Jan
28
awarded  Student
Jan
27
comment Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit?
that makes much more sense, but is it stipulated that the nonce be transmitted in the clear, or is there any actual vulnerability even if the nonces cannot be seen by a third party?
Jan
27
comment Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit?
The convenience of verifying smaller authenticated messages makes sense, but I don't think your assertions about addition/XOR collisions is true at all, and I've not seen any other claim about the GHash/GMAC fragility at longer message lengths. Do you have any sources on either of these claims?
Jan
27
comment Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit?
I agree with your point below about needing to scan an entire 64 GiB message before validating the whole is cumbersome, but I think your assertion here about XOR is mathematically incorrect. XOR or modular addition of a constant is a true 1-to-1 mapping of [0,2^n-1] to [0,2^n-1], so it's impossible for a given key and nonce tuple to have two distinct counter values that yield the same E(K, nonce XOR counter) output.
Jan
27
comment Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit?
I'm pretty certain that neither XOR nor modular addition of a counter harm uniqueness. There is no nonce for which two different counter values XOR or sum to the same value, unlike say with OR or AND.
Jan
27
asked Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit?
Jan
27
asked Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit?
Dec
11
awarded  Supporter