16h comment How do institutions like banks do RSA with big primes? But notice that OpenSSL is pretty fast with regards to these kind of calculations. You may have much worse results on interpreted code (e.g. on the JVM), let alone interpreted code. 16h comment GCM: Math behind update of AAD after ciphertext has been processed Well, it does work for sure. It seems that it first calculates $\operatorname{GHASH}_H(A_{0..x}||C)$ (including the zero padding), removes the padded $\operatorname{GHASH}_H(A_{0..x})$ and substitutes the new $A_{0...z}$, which was continued from the unpadded $\operatorname{GHASH}_H(A_{0..x})$... at least if I interpret the code correctly. 1d comment GCM: Math behind update of AAD after ciphertext has been processed So if there is already AAD data then we can just exponentiate the difference, where the difference is calculated with XOR, right? Bouncy also works for $A_{0..x} || C || A_{(x+1)..z}$... 2d comment What is the technical name for a public key container in DER format? I do not agree with the close votes. This is not about decoding or decrypting a piece of ciphertext, it is about identifying a cryptography related data structure. That is both a concise question and of use to others. 2d revised GCM: Math behind update of AAD after ciphertext has been processed added 57 characters in body; edited title Sep16 comment GCM: Math behind update of AAD after ciphertext has been processed I'm improving the GCM code of Bouncy Castle, making the nice properties of CTR return. I've already got everything running, but I still need to integrate this feature. I can do this better if I understand the involved mathematics. Sep16 asked GCM: Math behind update of AAD after ciphertext has been processed Sep11 revised AES-GCM Disadvantage deleted 3 characters in body Sep11 revised AES-GCM Disadvantage added 85 characters in body Sep11 comment AES-GCM Disadvantage Done, same to you, if you think it is unclear, edit or let me know. I thought disclosure of a key is too serious to ignore, I mean, an authentication function cannot get more broken than that. Sep11 comment AES-GCM Disadvantage I've removed my answer as Dimitry's answer is much better (don't forget to accept). But I'll put it here as a comment: the goal of the competition is to find better schemes of authenticated encryption. Even though GCM has many disadvantages, it seems mainly used as a base line within the competition. That does not mean that the previous modes have been broken, or that there is one particular advantage that they focus on. Sep11 comment AES-GCM Disadvantage In Authentication weaknesses in GCM Niels Fergusson states (about forgeries): "This quickly leads to a situation in which the attacker knows all of H, after which arbitrary forgeries can be created without any chance of detection by the receiver." where H is the data used as authentication key (!). So short tags leads to complete loss of authentication, even for ciphertext with a larger tag used later on. This is clearly a more potent statement than your second statement. Sep10 comment Advantages of using intermediate hash over full hash in digital signature application Still no substantial reasons other than that apparently some cryptographers want to maintain them in the standard. Sep8 comment Why does FIPS 186-4 require specific sizes for keys? I wish NIST would do the same for KDF's. It's a mess with multiple MB of test vectors, that still don't cover all the options, and all the verified implementations (CAVP) implement a different KDF's. Sep8 comment How can SSL secure a two-way communication with only one key-pair? Are there ciphersuites that only perform client authentication? Which ones? Sep8 comment Bit padding instead of PKCS#5 padding @PaŭloEbermann I guess in principle you could extract timing information, but finding timing information about unpadding a bit string may be tricky (as it will take almost no time at all). That said, it can be done, e.g. by carefully putting the plaintext + padding on a page boundary of a modern CPU. Paging can be used to extract timing information. Sep8 comment Bit padding instead of PKCS#5 padding @PaŭloEbermann Other Oracle attacks may be feasible of course, you may be able to use the errors generated by the application receiving the garbled plaintext to extract information about the plaintext. One of such attacks (on encrypted XML) is described here Sep8 revised Is this correct way to generate stream cipher using AES CTR mode? integrated comment of CodesInChaos Sep8 reviewed No Action Needed “Practical” operations supported by functional encryption? Sep8 reviewed No Action Needed Perfectly secure shift cipher