# What would be an adversary advantage in case of GCM authentication?

Philip Rogaway has written a formula for CCM mode where the adversary advantage is given as: $$adversary\_advantage \leq \frac{q_{dec}}{2^t} + \frac{\sigma^2}{2^b}$$

Can we use this formula to find GCM data integrity? Is there a similar document for GCM mode?

## 1 Answer

Can we use this formula to find GCM data integrity?

No. This bound only holds for CCM and can not easily be transferred to other modes as it depends on the security proof which is different for each mode.

Is there a similar document for GCM mode?

"Breaking and Repairing GCM Security Proofs" by Iwata, Ohashi and Minematsu (2012) has the current security proof for GCM. In section 7 you will find the various security bounds. As you specifically asked for the authenticity bound (Theorem 2) here it is:

$$\mathbf{Adv}^{\text{auth}}_{\operatorname{GCM}[\operatorname{Perm}(n),\tau]}\leq \frac{(\sigma+q+q'+1)^2}{2^{n+1}}+\frac{(q+q'+1)(\sigma+q)(l_N+1)}{2^{n-22}}+\frac{q'(l_A+1)}{2^\tau}$$

where

• $\tau$ is the length of the authentication tag in bits.
• $n$ is the block size of the permutation in bits, e.g. 128 for AES.
• $q$ is an upper bound for the number of answered encryption queries.
• $q'$ is an upper bound for the number of answered decryption queries.
• $\sigma$ is the total number of plaintext blocks (ie associated data blocks are not included and only encryption queries are considered).
• $l_N$ is an upper bound for the nonce-length in blocks.
• $l_A$ is an upper bound for the input length in blocks which includes associated data and plaintext (for decryption queries replace "plaintext" with "ciphertext")

If these variable descriptions are "too vague" for you, the start of section 7.3 has them as more formal definitions.