3
$\begingroup$

All block cipher modes of operation that I understand are generic schemes. They are not restricted by key size or block size. So why is GCM restricted to 128-bit block size?

$\endgroup$
  • $\begingroup$ For “what is it”, what reference materials (e.g. Wikipedia, the NIST specification) have you read, and what part don't you understand? $\endgroup$ – Gilles 'SO- stop being evil' Sep 30 '15 at 21:24
  • 2
    $\begingroup$ The way it's defined to be GCM restricts it to 128 bit. In detail it relies on a polynomial over a field of size 128 bit and you if you change this polynomial you can't call it "the GCM" anylonger. You can build something GCM-like for any block size. $\endgroup$ – SEJPM Sep 30 '15 at 21:27
  • $\begingroup$ @Gilles I've read bits and pieces about it. I know it's something like CCM. $\endgroup$ – Melab Oct 1 '15 at 0:00
  • $\begingroup$ @SEJPM Well why can't it be generalized? $\endgroup$ – Melab Oct 1 '15 at 0:01
  • $\begingroup$ @Melab It can be generalized, but there are many equally valid generalizations and the designers didn't bother to pick particular ones. $\endgroup$ – CodesInChaos Oct 1 '15 at 11:38
2
$\begingroup$

The field polynomial used for GHASH limits most definitions to 128-bit block size. That does not mean you could not define it for other sizes – the proposal defined it for 64-bit as well (pdf, see Appendix A) even if NIST did not standardize that.

However, defining it for arbitrary block sizes would be more difficult. You would need to define a deterministic method for constructing the polynomial and the changes that entails (see the document above). Since 64-bit block ciphers are usually considered too small these days anyway and no larger block sizes are in common use, there is no need to do that.

$\endgroup$
  • 1
    $\begingroup$ To make things worse, GHash's security doesn't scale down well to 64 bit MACs or smaller fields. $\endgroup$ – CodesInChaos Oct 1 '15 at 11:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.