Linked Questions

0 votes
1 answer
517 views

Can I use a fixed IV with AES-GCM if I only encrypt unique plaintext values? [duplicate]

My use case guarantees that all plaintext values are unique. In this case, is it safe to use a fixed IV with AES-GCM to carry our encryption/decryption?
savx2's user avatar
  • 441
11 votes
2 answers
7k views

Can AES-GCM be broken if initialisation vector is known?

We are using AES encryption in GCM block mode in order to encrypt a number of different kinds of data at rest on a mobile device - Android. The key used for encryption is stored in the protected key-...
Suhas's user avatar
  • 253
15 votes
1 answer
8k views

What are the rules for using AES-GCM correctly?

When using AES-GCM I know that I am supposed to use a new initialization vector every time I call the AES-GCM algorithm with the same key. What are other rules must be followed to use AES-GCM ...
ams's user avatar
  • 651
7 votes
2 answers
20k views

Is the Java function AES/CBC/PKCS5Padding vulnerable to padding oracle?

I have an application that stores data on the devices. Currently AES/CBC/PKCS5Padding from javax.crypto.Cipher(see reference) is ...
GarlicCheese's user avatar
4 votes
2 answers
3k views

How should I encrypt filenames in my scenario?

I'm writting a tool to save files (to external drive, cloud,...), it can already crypt file content with AES/GCM/NOPADDING; and as I'm not an expert, I've read some documentation, and understand that ...
Alexxx's user avatar
  • 143
3 votes
2 answers
2k views

Size of IV in AES-GCM according to RFC 4106

RFC 4106 specifies about nonce. It contains a salt of size 4 octets and an iv of size 8 octets. Further, RFC specifies that salt is assigned at the beginning of the security associations which is ...
user avatar
3 votes
1 answer
2k views

Using 0 nonce for AES-256 in CTR mode

My question is: I'm using AES with 256 bits key in CTR mode. Will it be less secure if I use a random key and static zero nonce? key = random; nonce = 0;
dr.computer's user avatar
2 votes
1 answer
1k views

Beyond birthday bound security in AES-GCM-SIV

AES-GCM-SIV takes a 96 bit nonce, like the original GCM. The RFC states that "it is RECOMMENDED to use this scheme with randomly chosen nonces". It uses the random nonce to generate per-...
Neil Madden's user avatar
3 votes
2 answers
2k views

Using AES-GCM (or AEAD ciphers in general) as a pure MAC without encryption

What's the opinion on using an AEAD cipher such as AES-GCM for example as a pure message authentication code (MAC) when only message authentication but not encryption is required. does it bring any ...
TrinityTonic's user avatar
3 votes
1 answer
769 views

OpenSSL not producing messages of expected size

I have a 16 byte file, and after encrypting it, its size weirdly changes. ...
user76487's user avatar
0 votes
1 answer
2k views

Why AES 256 GCM is more preferred by email service providers / banks over the fast and efficient ChaCha20 - Poly1305?

This question is based on my recent observation of preferences of certain email service providers and banks to use AES related symmetric ciphers over the more fast ChaCha20 Poly1305 . For example ...
Aravind A's user avatar
  • 1,030
3 votes
2 answers
1k views

Secure AES IV with static salt

I have an (offline) shared secret key (symmetric) which is used to encrypt/decrypt data. Now this data belongs to a specific user which is known on the backend and frontend. My idea was to use the ...
Shurpion's user avatar
5 votes
1 answer
292 views

Line by line encrypted logging stored with iv/salt/iterations. How safe is it?

I'm building an encrypted logging application. Log entries are encrypted with AES-256-GCM, using password-derived keys with PBKDF2. The application must support log rotation, and I would like to make ...
aspyct's user avatar
  • 183
2 votes
2 answers
161 views

Key Exhaustion Risks in Symmetric and Asymmetric Cryptography

For the symetric keys it is recommend that the same key should not be used to encrypt large number(2^32) of cipher blocks to avoid the key-exhaustion risk. Curious to know whether the asymmetric key ...
Bhuvan's user avatar
  • 123
5 votes
1 answer
246 views

What best to put in unused nonce bytes when using AES-GCM-SIV

I want to use AES-GCM-SIV for authenticated encryption of messages in my protocol. Since it is a wireless protocol I want to transmit as few bytes as possible. For successful decryption I need to ...
Karsten's user avatar
  • 151

15 30 50 per page