# Why does the Signal protocol use AES/CBC instead of AES/GCM?

AES/GCM has obviously proved itself to be better than AES/CBC. Unless the key is re-used with the same initialization vector (see disadvantages of GCM). More information on its advantages against CBC can be found in source 1 and source 2.

Now, most protocols still use AES/CBC. I understand this in case a KDF is not used. But currently, I am reading about the Signal Protocol which also uses AES/CBC with HKDF as the KDF.

So my question is: Why would Signal Protocol use AES/CBC when AES/GCM obviously has better performance?

## EDIT

I just tested (using JMH) AES/CBC vs AES/GCM on a Java implementation and AES/CBC actually beat AES/GCM in performance. I am aware now why Signal Protocol uses AES/CBC but I don't understand how. Signal documentation (section 3.3 after the image) says

"Alice then calculates an "associated data" byte sequence AD that contains identity information for both parties".

And later says Alice sends "An initial ciphertext encrypted with some AEAD encryption scheme 4 using AD as associated data and using an encryption key which is either SK or the output from some cryptographic PRF keyed by SK." Now I downloaded the Signal Protocol source (Java implementation) and did a search they never call updateAAD (a java function to set the additional authenticated data).

• Not an answer to your question, but if you like AES-GCM but are worried about IV re-use, you really should be using AES-GCM-SIV. Mar 20 '19 at 19:46
• Thank you @MaartenBodewes that was actually not obvious because in en.wikipedia.org/wiki/Galois/Counter_Mode they say "Different block cipher modes of operation can have significantly different performance and efficiency characteristics, even when used with the same block cipher. GCM can take full advantage of parallel processing and implementing GCM can make efficient use of an instruction pipeline or a hardware pipeline. In contrast, the cipher block chaining (CBC) mode of operation incurs significant pipeline stalls that hamper its efficiency and performance." Mar 21 '19 at 12:29
• You should focus on security goals like unauthenticated encryption (IND-CPA) or authenticated encryption with associated data (AEAD), not on Rube Goldberg diagrams of how to wire block ciphers up named with acronym soup. AES-CBC is an unauthenticated cipher; AES-GCM is an authenticated cipher. As such they are incomparable even if they both have diagrams that you can put side by side and squint at. You should look for where Signal does do authentication: maybe it uses AES-CBC with HMAC-SHA256 in encrypt-then-MAC composition to make an authenticated cipher, for instance. Mar 21 '19 at 14:58
• @SqueamishOssifrage Thanks for your help, with the details you just gave me I found out they do from looking at the class "org.whispersystems.libsignal.protocol.SignalMessage" and they append a 8 bytes HMAC result to an end of a message. Mar 21 '19 at 15:06
• Actually, it seems like the authors of the Signal protocol endorse either option. See signal.org/docs/specifications/doubleratchet, section 5.2, where it states, This function is recommended to be implemented with an AEAD encryption scheme based on either SIV or a composition of CBC with HMAC. Jul 23 '20 at 22:18