assuming that I have an RSA key of length 4k bit which I'm interested to wrap using AES-GCM, and I have a (limited) AES-GCM cipher which can only encrypt limited input in size (say 256-bit/512-bit input) per invocation. Is there a way/conditions to fulfill when splitting this 4k bit key into smaller keys to fit my (limited) AES-GCM and yet get the same security as when using an unlimited AES-GCM (encrypts 4k bits per invocation)? or is this proposed method inherently weaker?
5
-
1$\begingroup$ Are you sure that your cipher can only handle 256 or 512 bit input? What about the AAD input, does it have a higher data limit? Could you maybe link to the library/runtime because I find this claim highly doubtful. The main problem of encrypting chunks is that you can reorder or leave out chunks without breaking authentication errors. $\endgroup$– Maarten Bodewes ♦May 7 at 15:24
-
$\begingroup$ Hi Maarten, SW usually doesn't have these limitations, these limitations start appearing when moving from standard to HW. For the sake of our discussion lets assume that I have a limited piece of AES-GCM HW, and also we can keep AAD out as I'm not sure it changes the security of the GCM mode $\endgroup$– RamiMay 7 at 16:45
-
$\begingroup$ Yes, you can leave AAD out, but you could use AAD to create an authentication tag over the other authentication tags. $\endgroup$– Maarten Bodewes ♦May 7 at 21:23
-
1$\begingroup$ Or use the AAD to tag the location of each chunk (so that you cannot reorder or leave out chunks); part of the AAD could be effectively "this is chunk 5 of 7"; you could do that as well within the plaintext, but that reduces the amount of plaintext available to encoding the 4k bit key, which means you'll need more chunks overall $\endgroup$– ponchoMay 8 at 11:49
-
$\begingroup$ understood, do you think that this way is acceptable (FIPs for example) and as key wrapping mechanism? as their documents doesn't say so $\endgroup$– RamiMay 10 at 9:29
Add a comment
|