In the paper The Security and Performance of the GaloisCounter Mode(GCM) of Operation,it shows the AES GCM SECURITY in Corollary 1.

there are no distinguishing attacks against AES-N-GCM that work with distinguishing advantage greater than $A_{A E S-N}+q^{2} 2^{-116}-q 2^{-89.4}$

there are no forgery attacks against AES-N-GCM that work with forgery advantage greater than$A_{A E S-N}+q^{2} 2^{-116}-q 2^{-89.4}-q 2^{-128}$

But I can not get the same result (the right corollary) from the theorem 1 & 2 as the paper described when I plug in the value of parameters. Here are the Theorem 1 & 2:

enter image description here enter image description here enter image description here

I presented my calculating process below.

$A_{E} \geq A_{G C M}-q^{2} 2^{-129}\left(94^{2}+2 \times 2 \times 95\right)-q \times 95 \times 2^{-96}$ $A_{E} \geq A_{G C M}-q^{2} \times 9216 \times 2^{-129}-q \times 95 \times 2^{-96}$ $A_{E} \geq A_{G C M}-q^{2} 3^{2} \times 2^{-119}-q \times 2^{-89.4}$

I notice that my result has a $-q^{2} 3^{2} \times 2^{-119}$ item.However,the corollary in paper displays a $+q^{2} 2^{-116}$ .

  • 1
    $\begingroup$ Corollary 1 just plugs in some concrete values into the formulae of theorems 1 and 2. What are you confused about? Did you get a different formulae when you inserted the values (128 bit block size, 1500 byte plaintexts)? $\endgroup$ – poncho Jun 29 '20 at 12:13
  • $\begingroup$ @poncho Thanks for quick response, I have no idea why I just got the email message ...And yes,I plug in values ( w=128 , l(lv)=96 , t = 96 ,l =12000 ) and it doesn' t equal the Corollay 1. Could you please give a full calculation process about that? maybe I don't understand the paper well enough, your answer could be of great help.Thanks. $\endgroup$ – Pete Jul 3 '20 at 1:22
  • $\begingroup$ @poncho I have no idea how to get the corollay 1 .So please help me if i's convenient.Thanks a lot. $\endgroup$ – Pete Jul 4 '20 at 3:46
  • $\begingroup$ I've not rewarded the bounty yet as the difference between $2^{-119}$ and $2^{-116}$ isn't explained, although a factor of $2^3 = 8$ difference seems rather minimal in the grand scheme of things. $\endgroup$ – Maarten Bodewes Jul 9 '20 at 11:46

You appear to have computed things correctly. However, you have quoted their Corollary 1 wrong: you've included an extra $-q^22^{-128}$ term in the confidentiality part (don't know if that was what confused you though). To get their $2^{-89.4}$ instead of your $2^{-89.5}$ simply include more decimals of $\log_2(95)$.

  • $\begingroup$ It seems that there is indeed an "extra" term , but it just followed the process of pluging in the conceret values.I update my quesion so that you may understand why the term displays.@hakoja $\endgroup$ – Pete Jul 6 '20 at 8:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.