I have a case where it may be possible for an adversary to deduce the plaintext inputs that went into creating a AES-128-GCM encrypted message (there is good IV diversity across the encrypted messages, however) This opens up the potential to expose a GCM "oracle" to the adversary who may additionally be able to adaptively modify the inputs to the encryption function and observe the GCM encrypted outputs. I'm thinking about adding a random string of bytes of some fixed length to each encrypted message in order to prevent this (since an attacker would no be able to guess the random bytes that were appended and would therefore not know the full plaintext for a corresponding ciphertext). Some questions: 1) Can someone provide a "rule of thumb" around how much randomness should be appended to each message of a given length. 2) Does one need to take particular care around how the random byes are added an removed from the message 3) Are there any other methods one can employ in order to avoid exposing the encryption "oracle" described above?


1 Answer 1


GCM is authenticated encryption. As such, it is secure against chosen-plaintext attacks and against chosen-ciphertext attacks. Thus, there is no problem whatsoever with the adversary having access to an encryption oracle. It will not help it at all to break any of the encrypted messages.

  • $\begingroup$ A couple of questions: (1) Is it safe to assume that its OK to provide an encryption oracle to a CPA adversary so long as the encryption scheme $\pi$ has the property that for multiple encryptions $Pr[PrivK^{LR cpa}_{\mathcal{A},\pi}(n)=1]≤1/2+negl(n)$ (in the notation of Lindell and Katz),i.e, its safe to provide an oracle so long as the scheme is CPA secure for multiple encryptions, (2)If not, what is the exact definition that tells me when it's secure to expose an encryption oracle to a CPA adversary (3)for a CPA secure scheme, adding authentication additionally provides CCA security ? $\endgroup$ Jan 27, 2016 at 0:56
  • $\begingroup$ Yes, it's OK to expose an encryption oracle in this case. I wouldn't provide it freely if it's not a natural by-product of the application, but there's no reason to prevent it. $\endgroup$ Jan 27, 2016 at 13:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.