Is it possible to use DES or 3DES over Galois Counter Mode (GCM) to provide authenticated encryption?

I haven't seen any implementation yet.

  • 1
    $\begingroup$ Definitely don't use plain DES. Keyspace is too small. $\endgroup$
    – mikeazo
    Jun 18, 2015 at 19:05
  • $\begingroup$ @mikeazo thank you for mentioning that but I would like to know if it is possible to use that block cipher over GCM :) $\endgroup$ Jun 18, 2015 at 19:10
  • $\begingroup$ no. Or at least it would be non-standard. GCM needs to operate on $GF(2^{128})$ and plain (3)DES can at maximum operate at $GF(2^{64})$ as the blocksize is 64. One can of course chose a different polynomial, but this wouldn't be "GCM" any longer but rather CTR+custom GMAC. $\endgroup$
    – SEJPM
    Jun 18, 2015 at 19:16
  • $\begingroup$ @SOJPM I would rather think of a method to combine two blocks to create a block size of 128 bit instead, I've got an inkling of a feeling that using a block size and polynomial of 64 bit will break down the security to unacceptable levels. $\endgroup$
    – Maarten Bodewes
    Jun 18, 2015 at 19:56
  • $\begingroup$ @SOJPM Turned that into a question, I couldn't directly come up with the answer myself. There may be an answer in FPE, we'll see. $\endgroup$
    – Maarten Bodewes
    Jun 18, 2015 at 20:07

2 Answers 2


According to Wikipedia,

GCM is defined for block ciphers with a block size of 128 bits.

So no, you can't use GCM with 3DES or DES, because of the 64-bit block size. You could use something similar to GCM, but it wouldn't be GCM.

  • 1
    $\begingroup$ Alternatively, you could use the answer to this question to turn 3DES into a 128-bit block cipher. $\endgroup$ Jun 18, 2015 at 22:41
  • $\begingroup$ yes, that is possible, but it wouldn't be GCM with 3DES. it would be GCM with some cipher based on 3DES. $\endgroup$ Jun 19, 2015 at 1:55

GCM can be defined with 64-bit ciphers, see Appendix A of here: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/gcm/gcm-spec.pdf

NISTs's final GCM spec doesn't include this option. I suspect that this is because the security of GCM's MAC component depends on the difference between the number of blocks in the longest possible message and the number of elements in the polynomial field (see, e.g., here: https://eprint.iacr.org/2013/144).

Briefly, an untruncated GCM tag gives you an $m/|F|$ probability of forging (where m is the block-length of the longest possible message) and F is the field in which you evaluate the polynomial. Choosing $F = GF(2^{64})$ doesn't leave you much scope for messages before that forgery probability is quite large.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.