Skip to main content
added 255 characters in body
Source Link
K.G.
  • 4.8k
  • 18
  • 33

If you don't mind that the ciphertext is longer than the plaintext, GCM is perfectly fine for storage encryption. Every time you write a block to disk, choose a fresh nonce and write the resulting ciphertext to disk. (You can ask for even stronger security properties, but then everything gets more expensive. Basically, build a tree structure for tags. Reads and writes are no longer constant time, but logarithmic in the size of the disk. This is bad for spinning disks when you have significant seek times, but may be ok otherwise.)

If you want non-expanding encryption (ciphertext length is the same as plaintext length), then GCM is not appropriate, because it is very weak when IV's are reused, and there's no space for the authentication tag (GCM without authentication is just a form of counter mode).

While it is certainly possible to modify GCM into something secure (for a suitable definition of secure), the modifications would be significant and you could hardly call the resulting scheme GCM anymore.

If you just have ana black-box implementation of GCM, I would expect it to be difficult to use that as a building block for a secure non-expanding scheme in any sensible way.

If you have access to the components used to build GCM (the block cipher, finite field multiplicationsarithmetic, etc.), then they may be useful for building a secure scheme.

If you don't mind that the ciphertext is longer than the plaintext, GCM is perfectly fine.

If you want non-expanding encryption (ciphertext length is the same as plaintext length), then GCM is not appropriate, because it is very weak when IV's are reused, and there's no space for the authentication tag (GCM without authentication is just a form of counter mode).

While it is certainly possible to modify GCM into something secure (for a suitable definition of secure), the modifications would be significant and you could hardly call the resulting scheme GCM anymore.

If you just have an implementation of GCM, I would expect it to be difficult to use that as a building block for a secure scheme in any sensible way.

If you have access to the components used to build GCM (the block cipher, finite field multiplications, etc.), then they may be useful for building a secure scheme.

If you don't mind that the ciphertext is longer than the plaintext, GCM is perfectly fine for storage encryption. Every time you write a block to disk, choose a fresh nonce and write the resulting ciphertext to disk. (You can ask for even stronger security properties, but then everything gets more expensive. Basically, build a tree structure for tags. Reads and writes are no longer constant time, but logarithmic in the size of the disk. This is bad for spinning disks when you have significant seek times, but may be ok otherwise.)

If you want non-expanding encryption (ciphertext length is the same as plaintext length), then GCM is not appropriate, because it is very weak when IV's are reused, and there's no space for the authentication tag (GCM without authentication is just a form of counter mode).

If you just have a black-box implementation of GCM, I would expect it to be difficult to use that as a building block for a secure non-expanding scheme in any sensible way.

If you have access to the components used to build GCM (the block cipher, finite field arithmetic, etc.), then they may be useful for building a secure scheme.

Source Link
K.G.
  • 4.8k
  • 18
  • 33

If you don't mind that the ciphertext is longer than the plaintext, GCM is perfectly fine.

If you want non-expanding encryption (ciphertext length is the same as plaintext length), then GCM is not appropriate, because it is very weak when IV's are reused, and there's no space for the authentication tag (GCM without authentication is just a form of counter mode).

While it is certainly possible to modify GCM into something secure (for a suitable definition of secure), the modifications would be significant and you could hardly call the resulting scheme GCM anymore.

If you just have an implementation of GCM, I would expect it to be difficult to use that as a building block for a secure scheme in any sensible way.

If you have access to the components used to build GCM (the block cipher, finite field multiplications, etc.), then they may be useful for building a secure scheme.