Linked Questions
32 questions linked to/from What are the rules for using AES-GCM correctly?
16
votes
3
answers
19k
views
Has AES-128 been fully broken?
Has AES-128 been broken over the full 10 rounds? If so, by what means? By a commercial entity? By a supercomputer?
If not, why is AES-256 used to replace AES-128 so frequently?
- 283
39
votes
2
answers
32k
views
AES-GCM recommended IV size: Why 12 bytes?
When using AES-GCM, a 96-bit IV is generally recommended. Most implementations I've seen also use 96-bit. However, I'm unsure on where this recommendation or convention comes from.
Let's assume a ...
- 493
19
votes
5
answers
3k
views
AES GCM : is it acceptable to return the wrong plaintext if the tag is incorrect?
Let's start by saying I'm no cryptography expert, I'm just a developer, so feel free to correct me (using words, not downvotes) if what I'm saying is non-sense.
Context: I'm doing some crypto as a ...
- 293
23
votes
2
answers
20k
views
How bad it is using the same IV twice with AES/GCM?
I understand that initialization vectors (IV) should not be used twice when using AES/GCM. I am using a counter as an initialization vector. Every time I send out a new packet (I am developing an UDP ...
- 1,375
13
votes
4
answers
7k
views
Disadvantages of AES-CTR?
On paper, it sounds *very* good to me:
secure
fast (in my tests it's somewhat slower than ECB (but without most of the weaknesses, more on that below) but faster than every other alternative I tested,...
- 487
11
votes
1
answer
2k
views
What is universal composability guaranteeing, specifically? Where does it apply, and where does it not?
I don't have a proper computer science education, so bear with my misunderstandings.
UC is supposed to "guarantee strong security properties". From what I stand, if you have some secure ...
- 322
2
votes
2
answers
2k
views
Which block cipher mode of operation does TLS 1.3 use?
Which block cipher mode of operation does TLS 1.3 use? I assume it is a block cipher mode that provides authentication (like GCM).
- 97
14
votes
2
answers
1k
views
Does GCM (or GHASH) only provide 64-bit security against forgeries?
In a recent comment a doubt was voiced about my answer, which claims GCM to requires $2^{128}$ for a successful forgery. The doubt was that the square root needs to be taken meaning the security would ...
- 45.6k
9
votes
2
answers
4k
views
Changing an Encryption scheme from AES to ChaCha20
I am using the AES cipher for my OTT platform. Almost all Chip vendors (ARM, Intel, etc) have built-in AES for faster and secure processing.
Now, how feasible it is to move from AES to ChaCha20? ...
- 620
6
votes
2
answers
3k
views
GMAC vs HMAC in message forgery and bandwidth
Saarinen in his work GCM, GHASH and Weak Keys says that:
The GHASH algorithm belongs to a widely studied class of Wegman-Carter
polynomial universal hashes. The security bounds known (this and ...
- 46.3k
3
votes
2
answers
3k
views
So is AES-256 more secure or less secure than AES-128 after all?
It seems there are attacks that work more effectively on AES-256 than AES-128, which makes it less secure in some cases. But the bigger key size should add some safety margin on the other hand, for ...
- 739
4
votes
3
answers
1k
views
Designing a secure UDP-based communication protocol
SUMMARY UPDATE:
I have changed the title of this question from "Using an encrypted packet counter as a counter value in AES-CTR" to "Designing a secure UDP-based communication protocol&...
- 151
3
votes
2
answers
4k
views
What is a good AES mode to use on file encryption?
I'm new to encryption and cryptography, I was wondering if there is a good or best suited AES mode for file encryption (Planning on zipping a folder and encrypt it as a file). If there is, how complex ...
- 31
4
votes
3
answers
518
views
Why is AES better than one-time pad?
From my limited research into this topic, it seems that AES can be brute-forced. One-time pad, on the other hand, cannot. Why then is it better to use AES than it is to use one-time pad? The only ...
- 300
2
votes
2
answers
376
views
Is E_k(M)||H(m) form of MAC secure?
Would this encryption and signing scenario be considered tamper-proof?
...
- 421