Consequences of AES-GCM always encrypting the same plaintext

Question

I am analysing an authentication protocol. In this protocol AES-GCM is used to encrypt part of the messages.

Regarding the authentication protocol, I made the following observations:

• The plaintext that is being encrypted is always the same. It may be assumed that the plaintext is known by the adversary.
• Deterministic construction is used for the IV. It can be assumed that the IVs are also known by the adversary.
• only two blocks of data are encrypted.

So, the only thing that changes during different runs of the authentication protocol is the IV (but these IVs are known by the adversary).

My intuition tells me that it is not a good idea to always encrypt the same plaintext. I have the feeling that this may leak information about the encryption key?

So, my question is:

• Can the encryption key be compromised if you have enough transcripts of protocol runs?
• How many protocol runs would you need (AES-128-GCM is used)?

Answer 1

The main obligation for the AES-GCM is never to reuse a (Key, IV) pair.

Can the encryption key be compromised if you have enough transcripts of protocol runs?

How many protocol runs would you need (AES-128-GCM is used)?

The standard IV size is 96-bits. If sequentially used (as NIST says counter/LFSR ) then one cannot finish this IV space in a lifetime. Once reuse occurs, however, with a system failure etc., then the confidentiality is revealed and the same string that always sent is compromised.

Also, using the same key with a new random IV can cause replay attacks. The attacker can just re-transmit and old data. It is valid since the same key is used. Mitigation is putting time-tamps on the encrypted message. A new key establishment per record is better as used in TLS 1.3.

AES-GCM for single (Key, IV) pair the total encryption is most $2^{32} - 2$ blocks, or $2^{36} - 32$ bytes, or $2^{39} - 256$ bits. No problem here.

Once the keystream revealed with the key reuse, the attacker needs to execute a known-plaintext attack against AES-CTR. AES-CTR is secure against KPA attacks it has Ind-CPA.

The plaintext that is being encrypted is always the same. It may be assumed that the plaintext is known by the adversary.

The IV used in the encryption provides probabilistic encryption so that the same message will have different ciphertexts. This is crucial in modern Cryptography. And, again AES-CTR is secure against this KPA attack even Ind-CPA.

Suggestions:

1. Change the key with a predefined protocol.
2. Don't send the same message again, use new challenges in each message.
3. If the message is known to the adversary, what is the point of the encryption? You just give the attacker lost of known-plaintext that is normally hard to collect.
4. Use timestamps to protect againstt replay attacks,