Linked Questions

10
votes
2answers
4k views

Can AES-GCM be broken if initialisation vector is known?

We are using AES encryption in GCM block mode in order to encrypt a number of different kinds of data at rest on a mobile device - Android. The key used for encryption is stored in the protected key-...
4
votes
2answers
2k views

How should I encrypt filenames in my scenario?

I'm writting a tool to save files (to external drive, cloud,...), it can already crypt file content with AES/GCM/NOPADDING; and as I'm not an expert, I've read some documentation, and understand that ...
3
votes
2answers
250 views

Size of IV in AES-GCM according to RFC 4106

RFC 4106 specifies about nonce. It contains a salt of size 4 octets and an iv of size 8 octets. Further, RFC specifies that salt is assigned at the beginning of the security associations which is ...
5
votes
1answer
96 views

Line by line encrypted logging stored with iv/salt/iterations. How safe is it?

I'm building an encrypted logging application. Log entries are encrypted with AES-256-GCM, using password-derived keys with PBKDF2. The application must support log rotation, and I would like to make ...
4
votes
1answer
351 views

What are the rules for using AES-GCM correctly?

When using AES-GCM I know that I am supposed to use a new initialization vector every time I call the AES-GCM algorithm with the same key. What are other rules must be followed to use AES-GCM ...
4
votes
1answer
2k views

Is the Java function AES/CBC/PKCS5Padding vulnerable to padding oracle?

I have an application that stores data on the devices. Currently AES/CBC/PKCS5Padding from javax.crypto.Cipher(see reference) is ...
3
votes
1answer
645 views

Using 0 nonce for AES-256 in CTR mode

My question is: I'm using AES with 256 bits key in CTR mode. Will it be less secure if I use a random key and static zero nonce? key = random; nonce = 0;
3
votes
1answer
365 views

OpenSSL not producing messages of expected size

I have a 16 byte file, and after encrypting it, its size weirdly changes. ...
2
votes
1answer
29 views

Best suitable column type for openssl $tag,$iv,$key,$encrypted?

Which column type is best for storing $tag, $iv, $key, $encryptedData generated by openssl_encryption, and in which format I should save these values? I am using &...
0
votes
1answer
633 views

Why AES 256 GCM is more preferred by email service providers / banks over the fast and efficient ChaCha20 - Poly1305?

This question is based on my recent observation of preferences of certain email service providers and banks to use AES related symmetric ciphers over the more fast ChaCha20 Poly1305 . For example ...
0
votes
1answer
98 views

Can I use a fixed IV with AES-GCM if I only encrypt unique plaintext values? [duplicate]

My use case guarantees that all plaintext values are unique. In this case, is it safe to use a fixed IV with AES-GCM to carry our encryption/decryption?
9
votes
0answers
118 views

Are there any weak nonce-misuse resistant encryption scheme?

Nonce-misuse resistance seems to have two standard notions: The stronger notion: this reveals nothing unless the exact same nonce is used to encrypt the exact same message twice. In this case, the ...
0
votes
0answers
327 views

Can I Achieve Deterministic Encryption Using AES-GCM with Nonce = HMAC [ message ]

I would like to implement a deterministic encryption scheme within .NET. From the following post it is established using AES-SIV mode is appropriate. As AES-SIV mode is not implemented within the ...