7
$\begingroup$

AES/GCM has obviously proved itself to be better than AES/CBC. Unless the key is re-used with the same initialization vector (see disadvantages of GCM). More information of its advantages against CBC can be found in source 1 and source 2.

Now most protocols still use AES/CBC. I understand this in case a KDF is not used. But currently I am reading about the Signal Protocol which also uses AES/CBC with HKDF as the KDF.

So my question is: Why would Signal Protocol use AES/CBC when AES/GCM is obviously has better performance?

EDIT

I just tested (using JMH) AES/CBC vs AES/GCM on a Java implementation and AES/CBC actually beat AES/GCM in performance. I am aware now why Signal Protocol uses AES/CBC but I don't understand how. Signal documentation (section 3.3 after the image) says

"Alice then calculates an "associated data" byte sequence AD that contains identity information for both parties".

And later says Alice sends "An initial ciphertext encrypted with some AEAD encryption scheme 4 using AD as associated data and using an encryption key which is either SK or the output from some cryptographic PRF keyed by SK." Now I downloaded Signal Protocol source (Java implementation) and did a search they never call updateAAD (a java function to set the additional authenticated data).

| improve this question | |
$\endgroup$
  • 1
    $\begingroup$ Not an answer to your question, but if you like AES-GCM but are worried about IV re-use, you really should be using AES-GCM-SIV. $\endgroup$ – Ilmari Karonen Mar 20 '19 at 19:46
  • $\begingroup$ Thank you @IlmariKaronen but I am actually not worried since Signal Protocol uses KDF for each message meaning a new key is created for each mesasge (using HKDF) so as far as I know IV re-use isn't a problem as long as the keys aren't equal. $\endgroup$ – OughtToPrevail Mar 20 '19 at 19:52
  • $\begingroup$ According to the link you posted, CBC has significantly better performance, which is to be expected especially with small packet sizes $\endgroup$ – Tjaden Hess Mar 21 '19 at 0:50
  • 1
    $\begingroup$ Thank you @MaartenBodewes that was actually not obvious because in en.wikipedia.org/wiki/Galois/Counter_Mode they say "Different block cipher modes of operation can have significantly different performance and efficiency characteristics, even when used with the same block cipher. GCM can take full advantage of parallel processing and implementing GCM can make efficient use of an instruction pipeline or a hardware pipeline. In contrast, the cipher block chaining (CBC) mode of operation incurs significant pipeline stalls that hamper its efficiency and performance." $\endgroup$ – OughtToPrevail Mar 21 '19 at 12:29
  • 1
    $\begingroup$ You should focus on security goals like unauthenticated encryption (IND-CPA) or authenticated encryption with associated data (AEAD), not on Rube Goldberg diagrams of how to wire block ciphers up named with acronym soup. AES-CBC is an unauthenticated cipher; AES-GCM is an authenticated cipher. As such they are incomparable even if they both have diagrams that you can put side by side and squint at. You should look for where Signal does do authentication: maybe it uses AES-CBC with HMAC-SHA256 in encrypt-then-MAC composition to make an authenticated cipher, for instance. $\endgroup$ – Squeamish Ossifrage Mar 21 '19 at 14:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.