0
$\begingroup$

The purpose of the authentification is to ensure the data integrity. Let's just focus on the authentification part of the GCM which is using the Galois field multiplication to create an authentification tag. Eventually, this tag will be verified on the receiver side.

Say today I already have a CRC32 scheme that used in my system. May I know if they are serving for similar purpose. I do read some article saying, the hacker is able to alter the data which can still result the same CRC computed value in the end.

Does this mean Galois Field multiplication is doing better job for this?

$\endgroup$
  • $\begingroup$ More than that, it is keyed, not easy to find a collision for integrity as CRC32 and also provide authentication, too $\endgroup$ – kelalaka May 7 at 13:15
1
$\begingroup$

I do read some article saying, the hacker is able to alter the data which can still result the same CRC computed value in the end.

Obviously, yes. The CRC32 function is completely public, with no secret inputs. Hence, the attacker can compute the CRC32 of any modified data he wants, insert the tag, and it would validate. In contrast, GCM does have a secret input (that we need to assume the attacker does not know). Hence, the attacker cannot evaluate the GCM on his modified data in the same way.

Actually, the real answer is a bit deeper (and makes the contrast even stronger); CRC32 has a lot of symmetric internal properties that make it easy to compute the tag on modified data (even if the attacker doesn't see all of the data). In addition, with GCM, if we assume that the attacker does not know the key, and cannot break AES (and we never repeat nonces), then he has a provably tiny probability of being successful with any modification.

May I know if they are serving for similar purpose.

Similar? Well, CRC32 is a fine function if you want to detect accidental (not generated by an intelligent adversary) modifications with pretty decent probability. In fact, if most of the accidental modifications are burst errors (that is, the errors are limited to a few consecutive bits, and the rest of the message is unmodified), then it is actually better - CRC32 will detect all errors that are contained within a sequence of 32 consecutive bits. However, once you start talking about strength against an intelligent adversary, that's a completely different story.

Does this mean Galois Field multiplication is doing better job for this?

It's not about the multiplication, per se. Actually, you could modify CRC to have similar integrity properties as GCM (you'd need to expand the CRC, make the feedback polynomial secret, and stir in a per-message secret xor-mask). Instead, it's both the secret key, and the structure (that makes it so that if the attacker makes a modification to an existing message, the change that makes to the tag is unpredictable).

| improve this answer | |
$\endgroup$
  • $\begingroup$ It sounds to me the GCM only become robust when AES is in place. Or the key is the crucial. However, what if I have a scheme like compute the CRC32 followed-by encryption? So on the receiver side, the data cannot be decrypted successfully at all if it get altered. $\endgroup$ – Pi-Turn May 7 at 13:54
  • $\begingroup$ @Pi-Turn: AES, or some other piece to add computational complexity, yes. On the other hand, if you're doing encryption (which GCM implies), you already have that sort of thing in place. As for doing CRC32 on encrypted data, that's a bad idea. Many encryption methods are malleable; that is, the adversary can make changes to the ciphertext that makes predictable changes to the plaintext - CRC32 doesn't help you in that case. $\endgroup$ – poncho May 7 at 13:58
  • $\begingroup$ I guess one of the example your are referring here is AES-CBC. Attacker can simply to flip a bit in the ciphertext and the particular bit will be flip in the plain text as well. This will allow attacker still to modify the the Ciphertext but later compute the same CRC32 value at the end. Hence, the data authentification can not be guaranteed in this case. Agree? $\endgroup$ – Pi-Turn May 7 at 14:05
  • $\begingroup$ @Pi-Turn: CBC isn't a perfect example (the attacker can modify arbitrary bits in block X, but that causes random changes in block X-1 - of course, if he can modify the IV, there's no previous block that can cause the adversary problems. A better example might be counter mode - there, the attacker can flip arbitrary bits $\endgroup$ – poncho May 7 at 17:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.