0
$\begingroup$

I read from Is GCM mode of authenticated encryption quantum secure? that AES-GCM will be insecure if the attacker is allowed to perform entangled queries on your GCM implementation, and return entangled responses, then, no, GCM is known not to be secure against this model; the attacker can use Grover's algorithm on the decryption Oracle to find a second valid ciphertext/tag with a previous seen nonce with O(264) work.

will HMAC-256 with 256 bit tag used along with AES256-GCM protect against such a situation? Also AES-GCM is non key committing .will adding HMAC-256 protect it instead of using AES256-CBC or AES-CTR with HMAC-256?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
1
$\begingroup$

AES-GCM will be insecure if the attacker is allowed to perform entangled queries on your GCM implementation

However, it's been stated several times that this is an unrealistic scenario. I don't know enough on the topic to comment, but poncho and Squeamish Ossifrage know what they're talking about.

will HMAC-256 with 256 bit tag used along with AES256-GCM protect against such a situation?

The attack should be infeasible due to the longer tag.

Also AES-GCM is non key committing .will adding HMAC-256 protect it instead of using AES256-CBC or AES-CTR with HMAC-256?

AES-GCM-then-HMAC will be key- and message-committing if you derive the keys properly and use a 256-bit+ tag.

However, there's no point doing this because of the overhead of performing authentication twice and storing two tags. You'd be better off just doing AES-CTR-then-HMAC or (X)ChaCha20-then-BLAKE2b/BLAKE3. For misuse resistance, you can do XChaCha20-SIV.

AES-GCM alone is neither key- nor message-committing because of the 128-bit tag. Modifications to the design of AES-GCM can make it key-committing, but it won't be as strong as HMAC still, and you need to combine it with a hash function to make it message-committing.

AEADs should really have 256-bit tags, but that unfortunately hasn't happened and probably won't happen for quite some time. For instance, all the final portfolio AEADs from the CAESAR competition have 128-bit tags as far as I know. AEGIS-256 has a 256-bit key and opted for a 256-bit nonce but not a 256-bit tag.

Improve this answer
$\endgroup$
1
  • 1
    $\begingroup$ Beware that if you're going for e.g. AES-CTR + HMAC it is up to you to secure the protocol. For instance, I've seen many very naive implementations that forget to include the IV / nonce in the HMAC calculation. Of course, you'd also have the question how to handle the AAD. None of this is particularly hard, but without standardization... $\endgroup$
    – Maarten Bodewes ♦
    Aug 22, 2022 at 16:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.