Linked Questions
13 questions linked to/from How bad it is using the same IV twice with AES/GCM?
10
votes
2answers
4k views
Can AES-GCM be broken if initialisation vector is known?
We are using AES encryption in GCM block mode in order to encrypt a number of different kinds of data at rest on a mobile device - Android.
The key used for encryption is stored in the protected key-...
4
votes
2answers
2k views
How should I encrypt filenames in my scenario?
I'm writting a tool to save files (to external drive, cloud,...), it can already crypt file content with AES/GCM/NOPADDING; and as I'm not an expert, I've read some documentation, and understand that ...
3
votes
2answers
250 views
Size of IV in AES-GCM according to RFC 4106
RFC 4106 specifies about nonce. It contains a salt of size 4 octets and an iv of size 8 octets. Further, RFC specifies that salt is assigned at the beginning of the security associations which is ...
5
votes
1answer
96 views
Line by line encrypted logging stored with iv/salt/iterations. How safe is it?
I'm building an encrypted logging application. Log entries are encrypted with AES-256-GCM, using password-derived keys with PBKDF2.
The application must support log rotation, and I would like to make ...
4
votes
1answer
351 views
What are the rules for using AES-GCM correctly?
When using AES-GCM I know that I am supposed to use a new initialization vector every time I call the AES-GCM algorithm with the same key. What are other rules must be followed to use AES-GCM ...
4
votes
1answer
2k views
Is the Java function AES/CBC/PKCS5Padding vulnerable to padding oracle?
I have an application that stores data on the devices. Currently AES/CBC/PKCS5Padding from javax.crypto.Cipher(see reference) is ...
3
votes
1answer
645 views
Using 0 nonce for AES-256 in CTR mode
My question is: I'm using AES with 256 bits key in CTR mode. Will it be less secure if I use a random key and static zero nonce?
key = random;
nonce = 0;
3
votes
1answer
365 views
OpenSSL not producing messages of expected size
I have a 16 byte file, and after encrypting it, its size weirdly changes.
...
2
votes
1answer
29 views
Best suitable column type for openssl $tag,$iv,$key,$encrypted?
Which column type is best for storing $tag, $iv, $key, $encryptedData generated by openssl_encryption, and in which format I should save these values?
I am using &...
0
votes
1answer
633 views
Why AES 256 GCM is more preferred by email service providers / banks over the fast and efficient ChaCha20 - Poly1305?
This question is based on my recent observation of preferences of certain email service providers and banks to use AES related symmetric ciphers over the more fast ChaCha20 Poly1305 . For example ...
0
votes
1answer
98 views
Can I use a fixed IV with AES-GCM if I only encrypt unique plaintext values? [duplicate]
My use case guarantees that all plaintext values are unique. In this case, is it safe to use a fixed IV with AES-GCM to carry our encryption/decryption?
9
votes
0answers
118 views
Are there any weak nonce-misuse resistant encryption scheme?
Nonce-misuse resistance seems to have two standard notions:
The stronger notion: this reveals nothing unless the exact same nonce is used to encrypt the exact same message twice. In this case, the ...
0
votes
0answers
327 views
Can I Achieve Deterministic Encryption Using AES-GCM with Nonce = HMAC [ message ]
I would like to implement a deterministic encryption scheme within .NET. From the following post it is established using AES-SIV mode is appropriate. As AES-SIV mode is not implemented within the ...