The authenticated encryption mode of operation Galois/counter mode has recently gained acceptance because of its high performance due to its inherent parallelism and no pipeline stalls. It requires a block cipher having 128 bit block length which is used in counter mode, and authentication is done by using multiplication in the Galois field GF(2128).

However, some ciphers are stream ciphers instead of block ciphers. Could the block cipher used in counter mode be replaced with a stream cipher in the Galois/counter mode? Of course, it could not be called Galois/counter mode then due to not employing a counter. I think it could perhaps be called Galois/stream mode.

My initial intuition based on the picture at Wikipedia is that since the block cipher in this mode of operation is only used to encrypt an incrementing counter, a stream cipher could be used, with its output stream packetized to 128-bit packets. However, I am not a cryptography expert, so such a replacement could result in some unknown form of weakness.

One difficulty would be how to obtain the hash key (a block of zero bits encrypted by the key). Perhaps the first 128 bits of the stream cipher output could be used as the hash key?



Browse other questions tagged or ask your own question.