2
$\begingroup$

I am interested in using AES-GCM and after hours of reading on Internet I still have a few questions:

What will ensure the ICV, is it only Integrity ? If I don't need it on my purpose, can I spare it and still have secure encrypted data on my channel ? (If integrity is not verified, my packet will be dropped anyway)

our aim is just to encrypt data so that no one can get the information.

Thanks

$\endgroup$
1
  • $\begingroup$ in my opinion, ICV just exist in TKIP encryption mode, isn't it? You can refer it from here TKIP $\endgroup$ – jhanggj May 19 '17 at 7:33
4
$\begingroup$

ICV is the integrity check value (beware that it may also mean Initial Chaining Value). You cannot do without for GCM mode.

I'm not sure what you mean with: "If integrity is not verified, my packet will be dropped anyway". GCM uses an authentication tag which provides cryptographic integrity. Unless you have another way of adding cryptographic integrity then you cannot just skip verifying the tag.

If you do have another authentication tag, say HMAC over the ciphertext, then you don't need GCM. You could use AES-CTR mode instead. Except for some changes during initialization AES-CTR mode is used within GCM to provide confidentiality.

Beware that GCM and CTR modes do directly leak the plaintext size and possiblty timing information. That's something to solve - or not - at protocol level.

$\endgroup$
5
  • 1
    $\begingroup$ Thank you for quick answer. What I meant by ICV was "Integrity Check Value", which from what you said seems to be the AUTHENTIFICATION TAG. $\endgroup$ – clemy Mar 31 '17 at 15:34
  • $\begingroup$ Ah, don't you love these acronyms :) $\endgroup$ – Maarten Bodewes Mar 31 '17 at 17:23
  • $\begingroup$ I'd also point out that in many cryptosystems, not verifying the authenticity of the tag can counterintuitively result in partial or full plaintext recovery. $\endgroup$ – Stephen Touset Mar 31 '17 at 18:12
  • $\begingroup$ @StephenTouset Are you referring to things like plaintext / padding oracle attacks in transport protocols? $\endgroup$ – Maarten Bodewes Apr 1 '17 at 10:26
  • 1
    $\begingroup$ Yeah. Those specific attacks don't apply to CTR-based ciphers, but at this point I'm instinctually wary of any scheme that provides confidentiality but not authenticity. $\endgroup$ – Stephen Touset Apr 2 '17 at 2:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.