Linked Questions
33 questions linked to/from What are the rules for using AES-GCM correctly?
16
votes
3
answers
21k
views
Has AES-128 been fully broken?
Has AES-128 been broken over the full 10 rounds? If so, by what means? By a commercial entity? By a supercomputer?
If not, why is AES-256 used to replace AES-128 so frequently?
- 283
43
votes
2
answers
34k
views
AES-GCM recommended IV size: Why 12 bytes?
When using AES-GCM, a 96-bit IV is generally recommended. Most implementations I've seen also use 96-bit. However, I'm unsure on where this recommendation or convention comes from.
Let's assume a ...
- 533
19
votes
5
answers
3k
views
AES GCM : is it acceptable to return the wrong plaintext if the tag is incorrect?
Let's start by saying I'm no cryptography expert, I'm just a developer, so feel free to correct me (using words, not downvotes) if what I'm saying is non-sense.
Context: I'm doing some crypto as a ...
- 293
23
votes
2
answers
21k
views
How bad it is using the same IV twice with AES/GCM?
I understand that initialization vectors (IV) should not be used twice when using AES/GCM. I am using a counter as an initialization vector. Every time I send out a new packet (I am developing an UDP ...
- 1,375
11
votes
1
answer
2k
views
What is universal composability guaranteeing, specifically? Where does it apply, and where does it not?
I don't have a proper computer science education, so bear with my misunderstandings.
UC is supposed to "guarantee strong security properties". From what I stand, if you have some secure ...
- 322
13
votes
4
answers
8k
views
Disadvantages of AES-CTR?
On paper, it sounds *very* good to me:
secure
fast (in my tests it's somewhat slower than ECB (but without most of the weaknesses, more on that below) but faster than every other alternative I tested,...
- 487
2
votes
2
answers
3k
views
Which block cipher mode of operation does TLS 1.3 use?
Which block cipher mode of operation does TLS 1.3 use? I assume it is a block cipher mode that provides authentication (like GCM).
- 97
14
votes
2
answers
1k
views
Does GCM (or GHASH) only provide 64-bit security against forgeries?
In a recent comment a doubt was voiced about my answer, which claims GCM to requires $2^{128}$ for a successful forgery. The doubt was that the square root needs to be taken meaning the security would ...
- 45.7k
10
votes
2
answers
4k
views
Changing an Encryption scheme from AES to ChaCha20
I am using the AES cipher for my OTT platform. Almost all Chip vendors (ARM, Intel, etc) have built-in AES for faster and secure processing.
Now, how feasible it is to move from AES to ChaCha20? ...
- 630
6
votes
2
answers
3k
views
GMAC vs HMAC in message forgery and bandwidth
Saarinen in his work GCM, GHASH and Weak Keys says that:
The GHASH algorithm belongs to a widely studied class of Wegman-Carter
polynomial universal hashes. The security bounds known (this and ...
- 47.6k
3
votes
2
answers
4k
views
So is AES-256 more secure or less secure than AES-128 after all?
It seems there are attacks that work more effectively on AES-256 than AES-128, which makes it less secure in some cases. But the bigger key size should add some safety margin on the other hand, for ...
- 739
4
votes
3
answers
1k
views
Designing a secure UDP-based communication protocol
SUMMARY UPDATE:
I have changed the title of this question from "Using an encrypted packet counter as a counter value in AES-CTR" to "Designing a secure UDP-based communication protocol&...
- 151
3
votes
2
answers
4k
views
What is a good AES mode to use on file encryption?
I'm new to encryption and cryptography, I was wondering if there is a good or best suited AES mode for file encryption (Planning on zipping a folder and encrypt it as a file). If there is, how complex ...
- 31
4
votes
3
answers
573
views
Why is AES better than one-time pad?
From my limited research into this topic, it seems that AES can be brute-forced. One-time pad, on the other hand, cannot. Why then is it better to use AES than it is to use one-time pad? The only ...
- 300
3
votes
2
answers
910
views
For AES-GCM, does knowing plaintext and ciphertext allow attacker to learn the key?
Say, for an AES-GCM encryption, an attacker knows essentially everything except the key. This would include:
Plaintext
Ciphertext
IV
Algorithm (AES-GCM)
In this case, will the attacker gain any ...
- 133
2
votes
2
answers
397
views
Is E_k(M)||H(m) form of MAC secure?
Would this encryption and signing scenario be considered tamper-proof?
...
- 421
2
votes
2
answers
456
views
With AES-CTR does the block input need to be implemented as nonce || counter?
I am looking at an AES-CTR implementation (WebCrypto) and it takes an initialization parameter count which is an array of 16 bytes. It then asks you to specify <...
- 179
5
votes
1
answer
616
views
The Rationale behind NIST's counter/LFSR recommendation on deterministic IV constructions on SP 800-38D
The NIST has a "SP 800-38D: Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC". This guideline is a base for AES-GCM from definition to security ...
- 47.6k
0
votes
2
answers
928
views
How is AES256-GCM auth tag used in decryption
I have been playing with AES256-GCM in NodeJS crypto library and it shows that the original message can be decrypted without caring about the auth tag.
So can a non-tag verified decryption be secure? ...
- 155
2
votes
1
answer
769
views
AES CTR - Counter Management
Let ssuppose that we are using AES in CTR mode to encrypt a number of blocks ($x$ bytes each).
How is the current used IV (nonce+ctr) synchronized among both communicating entities?
I suppose that the ...
- 297
2
votes
1
answer
596
views
What does AES-GCM provide?
I am wondering does AES-GCM which uses Authenticated Encryption provide us with all 3 properties (Authenticity, Confidentiality, and Integrity), or does it not provide integrity?
- 161
0
votes
1
answer
550
views
Alternative to CBC mode encryption?
Given that CBC mode encryption is vulnerable to padding oracle attacks, what is the next best alternative ?
a) Include a hash check in the API scheme, validate the hash and then proceed with CBC. If ...
- 204
2
votes
2
answers
610
views
How much data can we encrypt using AES 256 before changing the key?
Although this question has been answered in this link (After How Much Data Encryption (AES-256) we should change key?), I am not satisfied with the answers because the Recommendation for Block Cipher ...
- 21
0
votes
1
answer
661
views
Consequences of AES-GCM always encrypting the same plaintext
I am analysing an authentication protocol. In this protocol AES-GCM is used to encrypt part of the messages.
Regarding the authentication protocol, I made the following observations:
The plaintext ...
- 31
1
vote
2
answers
445
views
Is it cryptographically insecure to use fixed-length AES-GCM messages?
Is there any weaknesses to encrypting fixed-length messages? Should a random amount of padding be added to the message to decrease the odds of some sort of attack?
user256686
0
votes
1
answer
471
views
Is a random string good for an AES-256 instance
I have a randomly generated string of about 256 characters long. This string is hashed to for a key and initialization vector for a program running on the .NET framework 4.8. Is this method secure ...
1
vote
1
answer
142
views
Do I need to change IV in AES-256 GCM when I only use encryption for challenge-response exchange with random string?
When I want to use encryption only for challenge-response exchange and not for hiding the contents of an encrypted message, is it still a threat to me not changing IV for new encryption?
For easier ...
- 143
1
vote
1
answer
109
views
Why are iterated substitution-permutation product ciphers only used on fixed-size plaintext blocks?
Another way to ask this question: when block ciphers were invented, why did they add the restriction that the block cipher would be restricted to blocks of a fixed size?
From my laymen's point of view,...
2
votes
1
answer
69
views
End-to-end photo storage
I've been tasked with developing an app that will need to store photos a user takes securely, and I've been struggling to think up a method to do this.
What I was thinking so far is as follows:
When ...
0
votes
0
answers
83
views
Is it possible to uncover the plaintext if IV is used twice but the key is different?
I am currently working on a cryptography challenge. The program uses AES-GCM to encrypt and decrypt strings.
Let's say I have the following:
IV which is reused
only 1 cipher text
authentication tag
...
- 101