Timeline for Is AES GCM without GMAC vulnerable against known plaintext attack?
Current License: CC BY-SA 4.0
13 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 7, 2022 at 20:45 | vote | accept | MichaelW | ||
| Feb 7, 2022 at 17:54 | history | edited | kelalaka | CC BY-SA 4.0 |
polish
|
| Feb 7, 2022 at 15:47 | comment | added | poncho | If they are discussing 'lets do GCM without passing or validating the tag', they're effectively saying 'lets use a broken version of GCM'. If they don't/can't spend the bandwidth to send the GCM tag, they shouldn't be using GCM at all. | |
| Feb 7, 2022 at 14:57 | answer | added | kelalaka | timeline score: 2 | |
| Feb 7, 2022 at 14:34 | comment | added | Marc Ilunga | Seems my autocorrect prefers HMAC to GMAC. Anyway, the statement should still hold. An addition could be that without GMAC, we fallback on CTR. | |
| Feb 7, 2022 at 14:30 | comment | added | MichaelW | I work for a real world project. There it can be chosen to use just encryption (GCM) or encryption + authentication (GCM/GMAC). There was a discussion to use GCM without GMAC, but I think for the reasons above this is quite dangerous. | |
| Feb 7, 2022 at 14:27 | comment | added | Martin Thompson | As far as I understand, GCM mode is defined to include the authentication code - from the spec "The two functions that comprise GCM are called authenticated encryption and authenticated decryption"... so without the GMAC, it is potentially vulnerable to all kinds of attacks. But you're not supposed to do that :) | |
| Feb 7, 2022 at 14:25 | comment | added | MichaelW | I talk about GMAC, not HMAC. | |
| Feb 7, 2022 at 14:24 | comment | added | MichaelW | Sorry, I mean "Lets assume the plaintext is known" | |
| Feb 7, 2022 at 14:24 | history | edited | MichaelW | CC BY-SA 4.0 |
deleted 1 character in body
|
| Feb 7, 2022 at 14:19 | comment | added | Marc Ilunga | HMAC ensures integrity, without it there is no way for the receiver to check that the ciphertext wasn't tampered with. Therefore, a number of attacks apply and in particular simple bitflips. | |
| Feb 7, 2022 at 14:15 | comment | added | Martin Thompson | Do you mean "Lets assume the plaintext is known"? | |
| Feb 7, 2022 at 14:04 | history | asked | MichaelW | CC BY-SA 4.0 |