Say that I encrypt a large file using aes-gcm and upload it somewhere. Can I then download only the first few blocks (as well as IV and tag) and decrypt them?
If not, is there another authenticated encryption that allows this?
$\begingroup$
$\endgroup$
5
-
3$\begingroup$ You can decrypt but no tag control! Do you want to skip the tag control? What is the need for this? possibly like this one; How to securely encrypt/decrypt data with a maximum chunk size?? $\endgroup$– kelalakaCommented Oct 29, 2021 at 19:22
-
$\begingroup$ I'd like to keep the integrity guarantee if possible. I know this is possible with, say, AES-CTR but I would prefer authenticated encryption. $\endgroup$– savx2Commented Oct 29, 2021 at 19:26
-
$\begingroup$ Never use plaintext before the tag control! $\endgroup$– kelalakaCommented Oct 29, 2021 at 19:27
-
$\begingroup$ so I guess the answer is that this is not possible unless you chunk the file and encrypt each chunk separately? $\endgroup$– savx2Commented Oct 29, 2021 at 19:30
-
2$\begingroup$ Yes, the reason for authentication is to ensure that the plaintext is not modified and authentic. Of course, GCM authenticates on the ciphertext so that we can verify even before decryption. $\endgroup$– kelalakaCommented Oct 29, 2021 at 19:36
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
Yes, you can decrypt a single AES-GCM partially. AES-GCM uses counter mode encryption, and you can decrypt counter mode from any specific offsite, assuming you know the nonce and method to calculate the counter values. Here is a Java implementation that takes GCM encryption and decrypts the ciphertext without verifying the tag and here is a way to run CTR mode encryption from any offset - the remaining trick is to combine the two.
However, to maintain authenticity you would still need to pass all data through the GMAC construct. As most implementations will perform both the GMAC and decryption pass at the same time you therefore may need to use a separate GMAC and counter mode implementation. For Java, if I remember correctly, GCM is implemented using relatively easy to split primitives within the Bouncy Castle lightweight API (specified by the classes in the org.bouncycastle package tree).
If you can design your own protocol you can indeed split your message into multiple chuncks and authenticate those separately. You should however make sure that an attacker cannot duplicate, delete or shuffle these chunks. Kelalaka has already indicated one scheme on how this can be done.
answered Oct 31, 2021 at 17:48