I have an implementation that natively uses the same IV (12 bytes of 0) for all encryption. The key is always a 32 byte SHA-512 hash. I know via this post that I can

  1. deduce the bit-wise XOR of the two plaintexts.

  2. deduce the internal authentication value, and thus modify the ciphertexts without being detected.

How can I achieve either of these?

  • $\begingroup$ What research have you done to answer these questions? Can you quote a definition of AES-GCM in algebraic equations that you can manipulate? $\endgroup$ – Squeamish Ossifrage May 12 '18 at 20:15
  • 1
    $\begingroup$ Funny, I cannot find a post that explains point 2.; I'm sure I saw that one. 1. is of course easy, just perform a many-time-pad attack on the CTR mode that forms the ciphertext (minus the authentication tag). $\endgroup$ – Maarten Bodewes May 12 '18 at 20:27
  • $\begingroup$ Actually, it should not be that hard. You know that $t \oplus t'$ XOR's the encryption of the first counter value from the equation, and then you've just GMAC over known data (the authenticaton data and ciphertext) with the only unknown being $H$, and no one way functions in there. $\endgroup$ – Maarten Bodewes May 12 '18 at 22:31
  • 1
    $\begingroup$ @MaartenBodewes Try joux' "forbidden attack". $\endgroup$ – cypherfox May 13 '18 at 9:40
  • $\begingroup$ This image on twitter already supplies the TL;DR :) twitter.com/tqbf/status/760910618228424704 $\endgroup$ – Maarten Bodewes May 13 '18 at 14:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.