All block cipher modes of operation that I understand are generic schemes. They are not restricted by key size or block size. So why is GCM restricted to 128-bit block size?
$\begingroup$
$\endgroup$
7
-
$\begingroup$ For “what is it”, what reference materials (e.g. Wikipedia, the NIST specification) have you read, and what part don't you understand? $\endgroup$– Gilles 'SO- stop being evil'Commented Sep 30, 2015 at 21:24
-
2$\begingroup$ The way it's defined to be GCM restricts it to 128 bit. In detail it relies on a polynomial over a field of size 128 bit and you if you change this polynomial you can't call it "the GCM" anylonger. You can build something GCM-like for any block size. $\endgroup$– SEJPMCommented Sep 30, 2015 at 21:27
-
$\begingroup$ @Gilles I've read bits and pieces about it. I know it's something like CCM. $\endgroup$– MelabCommented Oct 1, 2015 at 0:00
-
$\begingroup$ @SEJPM Well why can't it be generalized? $\endgroup$– MelabCommented Oct 1, 2015 at 0:01
-
$\begingroup$ @Melab It can be generalized, but there are many equally valid generalizations and the designers didn't bother to pick particular ones. $\endgroup$– CodesInChaosCommented Oct 1, 2015 at 11:38
|
Show 2 more comments
1 Answer
$\begingroup$
$\endgroup$
1
The field polynomial used for GHASH limits most definitions to 128-bit block size. That does not mean you could not define it for other sizes – the proposal defined it for 64-bit as well (pdf, see Appendix A) even if NIST did not standardize that.
However, defining it for arbitrary block sizes would be more difficult. You would need to define a deterministic method for constructing the polynomial and the changes that entails (see the document above). Since 64-bit block ciphers are usually considered too small these days anyway and no larger block sizes are in common use, there is no need to do that.
-
1$\begingroup$ To make things worse, GHash's security doesn't scale down well to 64 bit MACs or smaller fields. $\endgroup$ Commented Oct 1, 2015 at 11:39