7
$\begingroup$

Once gcm has been implemented for providing both encryption & authentication solution , it appears obvious to consider that such implementation can also provide (if required by new user) a Mac based authentication only service via using only Gmac instead of complete Gcm.

So I wondered if GMAC could or not be proposed as a serious / valid standalone Mac mode of operation when compared to well-known Hmac or Cmac.

I fear the answer is NO for at least the two following reasons but as not being a crypto expert I would be interested to get more pertinent advices:

  • first GMAC requires use of an iv which is not the case for other Mac modes; this induces additional overhead on the messages to carry associated iv (subset)

  • then GMAC is known to fail (ghash key disclosure) if iv uniqueness constraint is not strictly respected.Hmac or Cmac do not know that kind of risk as not using any iv

Is it correct or am I too much pessimistic about GMAC in regard with robustness & performances of Hmac or Cmac widely recognised modes ? .

Improve this question
$\endgroup$

1 Answer 1

Reset to default
6
$\begingroup$

To answer your question: yes, GMAC does have niche applications where it performs better than either HMAC or CMAC; however it might not make sense for you.

First of all, you are correct in that GMAC requires an IV, and bad things happen if a particular IV value is reused; this rather rules out GMAC for some applications, and is a cost even for applications that can live with it.

So, is there any application for GMAC where makes it worth paying this cost? Well, yes, there is; in hardware, you can do GMAC considerably faster than either HMAC or CMAC.

Suppose you have a stream of data running at 40,000,000,000 bits per second (that's 40Gbps) at we need to integrity-check. Even with aggressive hardware, neither HMAC nor CMAC can deal with data at that rate; GMAC can.

Now, that's very much a niche application; I rather suspect you'll never run into that yourself. I believe you're really asking "does GMAC make sense for what I'm doing"

Well, I can't give you a direct answer to that (partially because I'm not exactly certain what it is you're doing). However, it would appear to me that the only thing that GMAC buys you in your scenario is simplicity (you have a GCM implementation; GMAC is GCM with everything going into the AAD) and consistency (that way, the encryption and authentication-only cases are handled similarly). I cannot tell whether these advantages are worth the costs of GMAC, or whether you're better off tossing in (for example) an HMAC implementation to handle the authentication-only case.

Improve this answer
$\endgroup$
4
  • $\begingroup$ you are right one must consider both security & performance requirements. In my case (secure control of space vehicles) the major issue is the security while only low to medium data rates are considered. So I worry when I read from number of experts papers that "GMAC totally fails when iv is reused". in other side I fully understand your concern and I ignored that GMAC was so much fast and allowed to support very high data rates. this is effectively an important criteria.thanks $\endgroup$
    – william_fr
    Commented Jun 18, 2013 at 19:03
  • 1
    $\begingroup$ @william_fr please accept the answer if you think it sufficiently answers your question. $\endgroup$
    – Maarten Bodewes ♦
    Commented Jun 24, 2013 at 11:29
  • $\begingroup$ answer accepted . sorry for the delay i progressively discover present rules & tools. $\endgroup$
    – william_fr
    Commented Jun 25, 2013 at 9:49
  • 2
    $\begingroup$ Note that you will need to rekey quite often, as GHASH loses security as the amount of data sent per-key increases. $\endgroup$
    – Demi
    Commented Mar 7, 2016 at 17:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.