0
$\begingroup$

assuming that I have an RSA key of length 4k bit which I'm interested to wrap using AES-GCM, and I have a (limited) AES-GCM cipher which can only encrypt limited input in size (say 256-bit/512-bit input) per invocation. Is there a way/conditions to fulfill when splitting this 4k bit key into smaller keys to fit my (limited) AES-GCM and yet get the same security as when using an unlimited AES-GCM (encrypts 4k bits per invocation)? or is this proposed method inherently weaker?

$\endgroup$
5
  • 1
    $\begingroup$ Are you sure that your cipher can only handle 256 or 512 bit input? What about the AAD input, does it have a higher data limit? Could you maybe link to the library/runtime because I find this claim highly doubtful. The main problem of encrypting chunks is that you can reorder or leave out chunks without breaking authentication errors. $\endgroup$
    – Maarten Bodewes
    May 7, 2023 at 15:24
  • $\begingroup$ Hi Maarten, SW usually doesn't have these limitations, these limitations start appearing when moving from standard to HW. For the sake of our discussion lets assume that I have a limited piece of AES-GCM HW, and also we can keep AAD out as I'm not sure it changes the security of the GCM mode $\endgroup$
    – Rami
    May 7, 2023 at 16:45
  • $\begingroup$ Yes, you can leave AAD out, but you could use AAD to create an authentication tag over the other authentication tags. $\endgroup$
    – Maarten Bodewes
    May 7, 2023 at 21:23
  • 1
    $\begingroup$ Or use the AAD to tag the location of each chunk (so that you cannot reorder or leave out chunks); part of the AAD could be effectively "this is chunk 5 of 7"; you could do that as well within the plaintext, but that reduces the amount of plaintext available to encoding the 4k bit key, which means you'll need more chunks overall $\endgroup$
    – poncho
    May 8, 2023 at 11:49
  • $\begingroup$ understood, do you think that this way is acceptable (FIPs for example) and as key wrapping mechanism? as their documents doesn't say so $\endgroup$
    – Rami
    May 10, 2023 at 9:29

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.