I'm interested in developing software capable of encrypting personal files (which will ultimately be backed up to the cloud) and have been doing my best to follow best practices.

There are many forms of authenticated encryption. (AES-GCM, AES-SIV, AES-GCM-SIV, CBC + HMAC, CTR + HMAC, etc.) However, I'm having a hard time determining which of these modes-of-operation suits my use-case best. Speaking broadly:

I've heard many times that "GCM is harder to get right" due to the serious risks associated with nonce reuse as well as its predisposition to side-channel attacks if implemented poorly. Although it is fast.

I know AES-SIV is at least utilized by Cryptomator, a tool similar to what I'm trying to develop, (per their architecture docs). AES-SIV has a smaller penalty for nonce reuse compared to GCM but perhaps isn't as fast.

AES-GCM-SIV attempts to combine the positives of both GCM and SIV by being both fast and somewhat resistant to nonce reuse.

As far as CBC + HMAC is concerned, HMAC leverages 256-bit authentication tags over GHASH's weaker 128-bit authentication tags (used by GCM). However, CBC cannot be parallelized in the same way GCM can.

CTR + HMAC can be parallelized in a way similar to GCM but with stronger authentication tags. (Again, HMAC using 256-bit authentication tags over GHASH's 128-bit authentication tags)

Despite the reading I've done so far, I haven't been able to determine why one might choose one of these methods over the other. At the end of the day, I would really just like to secure my files safely in the cloud with at least some assurance that the files I encrypt are authentic and have not been tampered with or corrupted in any way.

I would really appreciate any help that could point me in the right direction.

  • $\begingroup$ I would do ctr+hmac(blake2) for backup $\endgroup$ – Richie Frame Jan 4 at 8:20
  • 3
    $\begingroup$ @RichieFrame Why CTR and HMAC-BLAKE2 instead of, say, ChaCha20-Poly1305? $\endgroup$ – forest Jan 4 at 9:03
  • 1
    $\begingroup$ @meci: Based on GCM is harder to get right I suppose you are going to implement by yourself one of these algorithms. I would discourage you from doing that. Or you are going to use some library and you are not sure if the authors have implemented it correctly? $\endgroup$ – mentallurg Jan 4 at 13:46
  • $\begingroup$ I think you've already got a pretty good overview of different modes, in the end you will have to make your own decision, not us. Personally I think this question is opinionated as such. I'd focus on the amount of data / files that can be encrypted using a key (or keys) for such purposes (next to performance, of course). $\endgroup$ – Maarten Bodewes Jan 4 at 14:40
  • $\begingroup$ @mentallurg I would certainly prefer to use somebody else's implementation if I can find a solid/trusted implementation of whatever scheme I choose. My concern with GCM is that perhaps, due to its complexities, it is more prone to poor implementation than the others. $\endgroup$ – meci Jan 4 at 15:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.