2
$\begingroup$

I am interested in using AES-GCM and after hours of reading on Internet I still have a few questions:

What will ensure the ICV, is it only Integrity ? If I don't need it on my purpose, can I spare it and still have secure encrypted data on my channel ? (If integrity is not verified, my packet will be dropped anyway)

our aim is just to encrypt data so that no one can get the information.

Thanks

$\endgroup$
1
  • $\begingroup$ in my opinion, ICV just exist in TKIP encryption mode, isn't it? You can refer it from here TKIP $\endgroup$
    – jhanggj
    May 19, 2017 at 7:33

1 Answer 1

4
$\begingroup$

ICV is the integrity check value (beware that it may also mean Initial Chaining Value). You cannot do without for GCM mode.

I'm not sure what you mean with: "If integrity is not verified, my packet will be dropped anyway". GCM uses an authentication tag which provides cryptographic integrity. Unless you have another way of adding cryptographic integrity then you cannot just skip verifying the tag.

If you do have another authentication tag, say HMAC over the ciphertext, then you don't need GCM. You could use AES-CTR mode instead. Except for some changes during initialization AES-CTR mode is used within GCM to provide confidentiality.

Beware that GCM and CTR modes do directly leak the plaintext size and possiblty timing information. That's something to solve - or not - at protocol level.

$\endgroup$
5
  • 1
    $\begingroup$ Thank you for quick answer. What I meant by ICV was "Integrity Check Value", which from what you said seems to be the AUTHENTIFICATION TAG. $\endgroup$
    – clemy
    Mar 31, 2017 at 15:34
  • $\begingroup$ Ah, don't you love these acronyms :) $\endgroup$
    – Maarten Bodewes
    Mar 31, 2017 at 17:23
  • $\begingroup$ I'd also point out that in many cryptosystems, not verifying the authenticity of the tag can counterintuitively result in partial or full plaintext recovery. $\endgroup$ Mar 31, 2017 at 18:12
  • $\begingroup$ @StephenTouset Are you referring to things like plaintext / padding oracle attacks in transport protocols? $\endgroup$
    – Maarten Bodewes
    Apr 1, 2017 at 10:26
  • 1
    $\begingroup$ Yeah. Those specific attacks don't apply to CTR-based ciphers, but at this point I'm instinctually wary of any scheme that provides confidentiality but not authenticity. $\endgroup$ Apr 2, 2017 at 2:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.