I am currently working on a cryptography challenge. The program uses AES-GCM to encrypt and decrypt strings.

Let's say I have the following:

  1. IV which is reused
  2. only 1 cipher text
  3. authentication tag
  4. AAD data

Is it possible to uncover the plaintext even if I don't have the key? I've read somewhere that IV reuse is bad but is this true even if the key is different?

  • $\begingroup$ AES-GCM internally uses CTR mode, for which IV-reuse is catastrophic. Using same IV, enables crib-dragging attack 1 2 on the ciphertext. And, even that can be automated. I'hope those are enough to solve your challange. $\endgroup$
    – kelalaka
    Sep 16, 2023 at 8:43
  • $\begingroup$ thanks for your help. For a crib-dragging attack, I would assume I need at least 2 cipher text encrypted with the same key and IV. however, I only have 1 cipher text now. the IV is 16 bytes instead of 12, will there be any issue on that? $\endgroup$
    – fdfdfd
    Sep 16, 2023 at 12:15
  • $\begingroup$ While GCM supports 16 byte IVs, that size would be unusual (the normal size is 12 bytes). Are you sure that GCM is being used here? $\endgroup$
    – poncho
    Sep 16, 2023 at 14:02
  • $\begingroup$ If 16-byte is used then GCM does extra GHASH call that complicated it's security analysis. I don't get the point that in the first of the list, it says the IV which is reused, This means that there must be either some means that you can create or some means that you can query. Otherwise, I don't see point of calling reused. $\endgroup$
    – kelalaka
    Sep 16, 2023 at 15:00
  • $\begingroup$ What does it mean that the IV is reused if there's just one ciphertext? $\endgroup$
    – Mikero
    Sep 16, 2023 at 17:15


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.