Linked Questions
33 questions linked to/from What are the rules for using AES-GCM correctly?
0
votes
2
answers
911
views
How is AES256-GCM auth tag used in decryption
I have been playing with AES256-GCM in NodeJS crypto library and it shows that the original message can be decrypted without caring about the auth tag.
So can a non-tag verified decryption be secure? ...
- 155
11
votes
1
answer
2k
views
What is universal composability guaranteeing, specifically? Where does it apply, and where does it not?
I don't have a proper computer science education, so bear with my misunderstandings.
UC is supposed to "guarantee strong security properties". From what I stand, if you have some secure ...
- 322
5
votes
1
answer
613
views
The Rationale behind NIST's counter/LFSR recommendation on deterministic IV constructions on SP 800-38D
The NIST has a "SP 800-38D: Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC". This guideline is a base for AES-GCM from definition to security ...
- 47.5k
2
votes
1
answer
574
views
What does AES-GCM provide?
I am wondering does AES-GCM which uses Authenticated Encryption provide us with all 3 properties (Authenticity, Confidentiality, and Integrity), or does it not provide integrity?
- 161
2
votes
1
answer
764
views
AES CTR - Counter Management
Let ssuppose that we are using AES in CTR mode to encrypt a number of blocks ($x$ bytes each).
How is the current used IV (nonce+ctr) synchronized among both communicating entities?
I suppose that the ...
- 297
2
votes
1
answer
69
views
End-to-end photo storage
I've been tasked with developing an app that will need to store photos a user takes securely, and I've been struggling to think up a method to do this.
What I was thinking so far is as follows:
When ...
1
vote
1
answer
141
views
Do I need to change IV in AES-256 GCM when I only use encryption for challenge-response exchange with random string?
When I want to use encryption only for challenge-response exchange and not for hiding the contents of an encrypted message, is it still a threat to me not changing IV for new encryption?
For easier ...
- 143
1
vote
1
answer
109
views
Why are iterated substitution-permutation product ciphers only used on fixed-size plaintext blocks?
Another way to ask this question: when block ciphers were invented, why did they add the restriction that the block cipher would be restricted to blocks of a fixed size?
From my laymen's point of view,...
0
votes
1
answer
55
views
Can we have an asymmetric key in AES? Clarification about PBKDF2 and AES-GCM in WebCrypto
Can we have an asymmetric key in AES? Clarification about PBKDF2 and AES-GCM in WebCrypto
According to wikipedia AES page, AES is a symmetric-key algorithm.
The algorithm described by AES is a ...
- 101
0
votes
1
answer
544
views
Alternative to CBC mode encryption?
Given that CBC mode encryption is vulnerable to padding oracle attacks, what is the next best alternative ?
a) Include a hash check in the API scheme, validate the hash and then proceed with CBC. If ...
- 204
0
votes
1
answer
467
views
Is a random string good for an AES-256 instance
I have a randomly generated string of about 256 characters long. This string is hashed to for a key and initialization vector for a program running on the .NET framework 4.8. Is this method secure ...
0
votes
1
answer
653
views
Consequences of AES-GCM always encrypting the same plaintext
I am analysing an authentication protocol. In this protocol AES-GCM is used to encrypt part of the messages.
Regarding the authentication protocol, I made the following observations:
The plaintext ...
- 31
1
vote
0
answers
65
views
Weaknesses of AES-GCM [duplicate]
Besides the limited nonce size of 96 bits, are there any other weaknesses to the GCM mode of AES?
I am creating a password vault and am trying to narrow down my options of encryption schemes.
Also, is ...
- 11
1
vote
0
answers
39
views
How safe is store nonce with encrypted text? [duplicate]
I am using AESGCM256 with a nonce of 96 bytes to store keys (very secret information). There are more than 500 keys, the only place where they can be stored in ...
- 11
0
votes
0
answers
83
views
Is it possible to uncover the plaintext if IV is used twice but the key is different?
I am currently working on a cryptography challenge. The program uses AES-GCM to encrypt and decrypt strings.
Let's say I have the following:
IV which is reused
only 1 cipher text
authentication tag
...
- 101