Questions tagged [aes-gcm]
Deprecated tag, see tag info. Advanced Encryption Standard Galois/Counter Mode, better known as AES-GCM is a mode of operation for symmetric key cryptographic block ciphers that has been widely adopted because of its efficiency and performance. GCM supports authenticated encryption, meaning that the mode not only offers privacy, but also integrity.
180
questions
2
votes
1
answer
223
views
Is it possible to reverse GHASH from GCM?
How can I create a "reverse" GHASH algorithm for GCM that allows me to compute an input value that generates a specific chosen output, given that I know the authentication key H? If this is ...
- 29
3
votes
1
answer
49
views
GCM-SIV vs CBC with fixed IV?
I keep hearing CBC with fixed IV mode is bad because it has similar issues to the codebook breakdown of ECB mode. However, people seem quite willing to recommend AES-GCM-SIV for deterministic ...
- 31
0
votes
1
answer
37
views
Implementing AES GCM but not getting correct output from cipher block
I'm implementing 128-bit AES-GCM (but only the encryption/AES-CTR aspect).
When I set the Secret Key, Plaintext and IV to Test Case 2, page 27 of the GCM spec (see below) I get the wrong value for the ...
- 117
0
votes
1
answer
32
views
AES GCM Difference between the IV and the Secret Key?
Below is part of AES GCM diagram. However, it only shows the behavior of the IV/counter.
The GCM specification examples state both an IV and a Secret Key as two inputs.
Can someone please explain ...
- 117
1
vote
1
answer
56
views
Drawbacks of multiple sources of entropy for AES
Since AES needs IV to be random (unless fed by a unit test), I was wondering how to properly handle it.
I know that Intel/AMD now supports the rdrand64 function but ...
- 23
1
vote
1
answer
48
views
AES256-GCM padding for unaligned blocks
So I found some test vectors for my SSE implementation of AES256-GCM and unfortunately it seems that after the last step of AAD it goes wrong. My guess is that this is because the AAD is actually ...
- 23
4
votes
2
answers
746
views
OpenSSL AES-GCM says 'bad decrypt', other block modes work fine?
If I do a simple encrypt and decrypt test like so:
...
- 1,387
2
votes
1
answer
185
views
AES-GCM with HMAC
I am using AES-GCM to encrypt some data. I want every encryption to be done with a new random iv. For every encryption a new iv is generated and appended to the encrypted text to produce the cipher. ...
- 21
2
votes
1
answer
204
views
Understanding AES-GCM IV (Nonce), Tag/MAC, Message & Transmission
I am working on a project that uses PAKE (SRP) for authentication. When we send the M1 to the server we are encrypting the payload using AES-GCM. I mention SRP only to set the context:
A message is ...
- 123
1
vote
1
answer
156
views
What does AES-GCM provide?
I am wondering does AES-GCM which uses Authenticated Encryption provide us with all 3 properties (Authenticity, Confidentiality, and Integrity), or does it not provide integrity?
- 151
1
vote
1
answer
826
views
How long does it take to decrypt AES encrypted message with salt(for pbkdf2 key) and iv known
I'm new to crypto!
The situation is,
Aes-256-cbc encrypted message(including not encrypted iv & salt) is revealed.
We also know pbkdf2 function uses 10000 rounds with sha256.
All we need to ...
- 11
1
vote
0
answers
55
views
Should I encrypt individual columns or all data?
I want to AES-GCM some user data that I‘m going to persist in a database. I‘m wondering if I should encrypt individual columns (all with an individual IV ofc) or JSON stringify the sensitive data and ...
- 111
0
votes
0
answers
76
views
How can I show that AES-GCM is secure under the adaptive chosen cipher-text game?
How can I show that AES-GCM is secure under the adaptive chosen ciphertext game?
This is assuming the GHASH Mac tag can't be forged faster than brute force?
- 151
0
votes
0
answers
256
views
Decryption failure for NIST vector AES-CBC-128
I am learning/exploring the openssl library for encrypting and decrypting data
while encryption goes through fine I see standalone decryption not working as I expected.
The test vector I am using is
<...
- 1
1
vote
1
answer
297
views
How are long IVs used in AES-GCM?
I looked through NIST's official test vectors (CAVP) for the AES-GCM mode, and noticed that there are some test vectors in there with 8-bit or 1024-bit IVs. But as far as I understand, the GCM ...
- 201
0
votes
1
answer
156
views
What is the use of Additional data or associated data in AESGcm. How it is used while encryption and decryption [closed]
I am trying to understand the AESGcm encryption and decryption and there's one field associated data in Encryption and Decryption methods.
https://learn.microsoft.com/en-us/dotnet/api/system.security....
1
vote
0
answers
72
views
Using a signature as key material
I am designing my first web3 app and I would like to use MetaMask as an identity and crypto provider. My web3 app will encrypt user data with AES-GCM, but I do not want to generate and store an ...
- 11
0
votes
1
answer
77
views
Is MAC unnecessary for client side encryption?
In my open source with offline client side encryption application, I plan to use AES-CTR or ChaCha20 without MAC instead of GCM or Poly1305 since:
There is no database, the ciphertext, nonce, tag ...
- 155
0
votes
2
answers
401
views
How is AES256-GCM auth tag used in decryption
I have been playing with AES256-GCM in NodeJS crypto library and it shows that the original message can be decrypted without caring about the auth tag.
So can a non-tag verified decryption be secure? ...
- 155
0
votes
1
answer
510
views
How is AES-GCM IV and auth tag used?
I have been learning about AES-GCM and AES in general lately and founding:
The key is the secret and both sender and receiver keep it hidden forever.
The IV and auth tag are public and sent along with ...
- 155
1
vote
1
answer
405
views
Aes-Gcm how to perform decryption authentication without plaintext output in C#
I'm mainly trying to verify large file chunks which are encrypted each alone with a different key/salt/nonce for each chunk then appended to the whole file in the end to form 1 file.
One thing I ...
- 23
1
vote
1
answer
1k
views
How does AES GCM encryption work
Previously, I used AES CBC 256 with 256 bit key and 128 bit IV.
However it seems slow so I decide to switch to AES GCM 256 bit key, 96 bit IV which has some parts I don't understand such as:
Auth tag:...
- 155
1
vote
2
answers
196
views
Argon2id creating key for cryptography, how acceptable is it to use the same salt for the same encryption operation?
Everyone knows Argon2id is a slow hashing algorithm, and that's on purpose, all is good.
When creating an Argon2id object a lot of parameters are needed to be taken into consideration ultimately ...
- 23
1
vote
2
answers
427
views
Does the AES-GCM specification require the tag-size to be bound to the GCM context?
Does GCM spec (NIST SP 800-38D) require tag-size to be fixed for an instance of GCM algorithm (which usually fixes a specific GCM key)?
Asked differently, is the following a legitimate adherence to ...
- 43
0
votes
0
answers
60
views
Encrypt user AES keys with AWS KMS RSA key
I am developing a web application in which each user has some part of his data that is stored encrypted. We are hosted on AWS and I want to use KMS as part of the solution. To not make the solution ...
- 1
3
votes
1
answer
114
views
AES-GCM with different IVs but close enough for counter to cause duplicates
I am planning to use AES-GCM or AES-CTR for encryption. However, I have read from several sources that the IVs must be unique for every piece of information encrypted. I have a doubt though, what if I ...
- 33
1
vote
1
answer
567
views
Using AES-256-GCM, is your security only 128 bits when solely relying on the MAC?
Since the maximum authentication tag (MAC) size of AES-256-GCM is 16 bytes,
And given that in one implementation, that breaking the MAC would break the security (ex. when a boolean 'decrypted' is used ...
- 293
1
vote
1
answer
60
views
How does a GMAC in GCM not nullify the utility of a seekable decrypt-able stream
I have been looking at the Galois/Counter Mode (GCM) for stream encryption. I understand the idea that it's a stream cipher and so it can be encrypted one bit at a time by XORing with the key stream ...
- 113
3
votes
1
answer
177
views
Key Committing AES-GCM
There is a handful of attacks against AEAD, and GCM in particular, which demonstrates that it is feasible for an attacker $\mathcal{A}$ to obtain a ciphertext $C$ which encrypts to multiple key/...
2
votes
2
answers
579
views
For AES-GCM, does knowing plaintext and ciphertext allow attacker to learn the key?
Say, for an AES-GCM encryption, an attacker knows essentially everything except the key. This would include:
Plaintext
Ciphertext
IV
Algorithm (AES-GCM)
In this case, will the attacker gain any ...
- 123
0
votes
1
answer
84
views
AES GCM mode - what is ouput in that scheme?
I'm trying to understand that scheme:
https://xilinx.github.io/Vitis_Libraries/security/2019.2/guide_L1/internals/gcm.html
Here on page 11 it looks like GHASH gives only one value "Return $Y_m$&...
- 1,171
2
votes
1
answer
1k
views
Validating AES GCM authentication tag between two different implementations
I'm a bit confused on how to validate the authentication tag between two different AES GCM implementations.
One implementation (on my part) is in Java. The other, I don't know.
In my implementation, ...
- 23
1
vote
0
answers
315
views
How fast is GHASH and what does it do?
I read here:
https://www.researchgate.net/publication/220335697_GCM_GHASH_and_Weak_Keys
how GHASH works. So we have $m$ 128-bit blocks $X_{i}$ and we compute in $GF(2^{128})$:
$Y_{m} = \sum_{i=1}^{m} ...
- 1,171
1
vote
1
answer
1k
views
Is AES GCM with PBKDF2 100k iterations still ok as of 2022?
Is using AES GCM with PBKDF2 and 100 000 iterations still considered secure as of 2022?
In our threat model, if we ignore the risks linked to quantum computing, is this secure?
Here is an example ...
- 533
1
vote
1
answer
132
views
Clarification on nonce collision calculation
I've been working on a AES256-GCM implementation (in Java).
I'm a little bit stuck on the part where i need to decide how often i need to rotate my key.
I've got a lot of information from this posts:
...
- 13
1
vote
1
answer
146
views
some questions about IPSEC ESN
ESN feature is described in RFC 4303. Here is some questions which bothered me:
When use ESN combined with AES_GCM or AES_GMAC alogrithom, do I need to add the high-order ESN bits to the packets?
...
- 11
1
vote
1
answer
155
views
Multiple Encryption Using GCM For Multi-Key Security
Multiple Encryption For Multi-Key Security
I have a hypothetical question about multiple encryption after reading Matthew Green’s blog on multiple encryption. For those who are familiar with GCM…I ...
- 11
1
vote
1
answer
391
views
Is AES GCM without GMAC vulnerable against known plaintext attack?
Is AES GCM without GMAC vulnerable against bit-flip attacks? Let's assume the plaintext is known for some reason (e.g. it can be guessed). In my opinion, I can flip bits in the ciphered blocks and can ...
- 1,477
1
vote
0
answers
613
views
AES256-GCM Is it safe to both add the IV to the AAD and use it in the encryption?
I'm looking at a protocol which adds the IV (used for the encryption) into the AAD.
If the IV (which is part of the message) was incorrect, decryption would fail anyway.
Why is it useful to add the IV ...
- 771
1
vote
1
answer
721
views
Is it possible to partially decrypt an aes-gcm ciphertext?
Say that I encrypt a large file using aes-gcm and upload it somewhere. Can I then download only the first few blocks (as well as IV and tag) and decrypt them?
If not, is there another authenticated ...
- 431
4
votes
1
answer
317
views
Is GCM with zero-length AAD less secure?
In a previous question, it was made clear that in the case of GCM, there is no distinction between "no AAD" and "zero-length AAD". Since I have noticed "zero-length AAD" ...
- 171
-1
votes
1
answer
106
views
What would be the benefits of using a faster cryptographic system with the same level of security as AES
Essentially I'm asking, what if I have designed a quantum-proof stream cipher that is faster than AES-256?
Will using less computational power for encryption/decryption be valuable to companies or ...
1
vote
0
answers
35
views
How safe is store nonce with encrypted text? [duplicate]
I am using AESGCM256 with a nonce of 96 bytes to store keys (very secret information). There are more than 500 keys, the only place where they can be stored in ...
- 11
0
votes
1
answer
757
views
AES-GCM encryption in .NET Core
I created a crypto service using AES-GCM in order to encrypt the sensitive data in database. Firstly, I'm generating a cryptographic key from a password (probably will be stored in Kubernetes Secrets) ...
- 3
0
votes
1
answer
111
views
Security level of Poly1305 and GMAC
The Libsodium docs list the AEAD forgery limits for ChaCha20Poly1305 and AES-GCM which seems like a < 128-bit security level but says that it's not a practical concern. I've seen other people say ...
- 3
1
vote
1
answer
573
views
API key generation technique
I am designing an web api which needs to grant access to various client apps via an api key sent as http header. I know, not really how it should be done but I have no control over this part.
My ...
- 11
2
votes
2
answers
446
views
FOR AES GCM decrypt function, Does the output(PT) depend on Tag value(T)?
According to spec, FOR GCM decrypt function input is IV, A, C, and T. As mentioned below:
5.2.2 Authenticated Decryption Function Given the selection of an approved block cipher, key, and an ...
2
votes
1
answer
229
views
What benefit is gained when combining AES GCM/GMAC with ECDSA?
This is a real world question (and as I'm not an expert in cryptography I have only some basic knowledge in terms of just using it, not a deep understanding how ist works under the hood.): A system ...
- 1,477
0
votes
1
answer
119
views
What is the term to describe the combination of ciphertext, IV and authentication tag?
Authenticated encryption with associated data, such as AES-GCM, will take as input: IV, optional associated data, plaintext and key.
A ciphertext and an authentication tag will be produced.
Is there a ...
- 4,257
2
votes
1
answer
242
views
Can the AES-GCM authentication tag be used as a key derivation function?
I want to build a deterministic key derivation tree, where the root is stored securely in a centralized service and the leaves are embedded in a multitude of devices. When a device wants to ...
- 532