8k views

### Has AES-128 been fully broken?

Has AES-128 been broken over the full 10 rounds? If so, by what means? By a commercial entity? By a supercomputer? If not, why is AES-256 used to replace AES-128 so frequently?
17k views

### AES-GCM recommended IV size: Why 12 bytes?

When using AES-GCM, a 96-bit IV is generally recommended. Most implementations I've seen also use 96-bit. However, I'm unsure on where this recommendation or convention comes from. Let's assume a ...
2k views

### AES GCM : is it acceptable to return the wrong plaintext if the tag is incorrect?

Let's start by saying I'm no cryptography expert, I'm just a developer, so feel free to correct me (using words, not downvotes) if what I'm saying is non-sense. Context: I'm doing some crypto as a ...
9k views

### How bad it is using the same IV twice with AES/GCM?

I understand that initialization vectors (IV) should not be used twice when using AES/GCM. I am using a counter as an initialization vector. Every time I send out a new packet (I am developing an UDP ...
2k views

### Disadvantages of AES-CTR?

On paper, it sounds *very* good to me: secure fast (in my tests it's somewhat slower than ECB (but without most of the weaknesses, more on that below) but faster than every other alternative I tested,...
782 views

### Does GCM (or GHASH) only provide 64-bit security against forgeries?

In a recent comment a doubt was voiced about my answer, which claims GCM to requires $2^{128}$ for a successful forgery. The doubt was that the square root needs to be taken meaning the security would ...
2k views

### GMAC vs HMAC in message forgery and bandwidth

Saarinen in his work GCM, GHASH and Weak Keys says that: The GHASH algorithm belongs to a widely studied class of Wegman-Carter polynomial universal hashes. The security bounds known (this and ...
613 views

### Changing an Encryption scheme from AES to ChaCha20

I am using the AES cipher for my OTT platform. Almost all Chip vendors (ARM, Intel, etc) have built-in AES for faster and secure processing. Now, how feasible it is to move from AES to ChaCha20? ...
248 views

### What is universal composability guaranteeing, specifically? Where does it apply, and where does it not?

I don't have a proper computer science education, so bear with my misunderstandings. UC is supposed to "guarantee strong security properties". From what I stand, if you have some secure ...
293 views

### Is E_k(M)||H(m) form of MAC secure?

Would this encryption and signing scenario be considered tamper-proof? ...
279 views

### Designing a secure UDP-based communication protocol

SUMMARY UPDATE: I have changed the title of this question from "Using an encrypted packet counter as a counter value in AES-CTR" to "Designing a secure UDP-based communication protocol&...
89 views

### With AES-CTR does the block input need to be implemented as nonce || counter?

I am looking at an AES-CTR implementation (WebCrypto) and it takes an initialization parameter count which is an array of 16 bytes. It then asks you to specify <...
108 views

### The Rationale behind NIST's counter/LFSR recommendation on deterministic IV constructions on SP 800-38D

The NIST has a "SP 800-38D: Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC". This guideline is a base for AES-GCM from definition to security ...
104 views

### How much data can we encrypt using AES 256 before changing the key?

Although this question has been answered in this link (After How Much Data Encryption (AES-256) we should change key?), I am not satisfied with the answers because the Recommendation for Block Cipher ...
109 views

### Consequences of AES-GCM always encrypting the same plaintext

I am analysing an authentication protocol. In this protocol AES-GCM is used to encrypt part of the messages. Regarding the authentication protocol, I made the following observations: The plaintext ...

15 30 50 per page