The same message results in different cipher text every time AES-GCM is applied. If an attacker collects repeated messages over time, will he be able to extract the plain text if enough cipher text is collected?
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
2
If GCM is correctly applied then no, this is not the case.
Ciphertext output is supposed to be indistinguishable from random, so any secure mode of operation behaves in this way. If this was not the case then you could distinguish messages with the same value. That would not be considered secure.
GCM is not secure when (larger) parts of the message are identical. That would point to repetition of the IV / nonce. And as GCM uses CTR underneath it could almost instantly compromise the plaintext.
You would expect about half of the bits to change when comparing larger messages of identical size, as the Hamming distance is about half the message size for randomized messages.
answered Oct 20, 2017 at 9:28
-
$\begingroup$ In my case the message is completly identical but the IV is random and not re-used. $\endgroup$– aggsolCommented Oct 20, 2017 at 9:37
-
2$\begingroup$ Good, that's how it should be. Beware (for any mode of operation) that the size of ciphertext and timing of ciphertext creation could still leak information. This is something most people learn right at the start of courses in crypto, and then forget when it matters. $\endgroup$– Maarten Bodewes ♦Commented Oct 20, 2017 at 9:40