Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs

Questions tagged [aes-gcm]

Deprecated tag, see tag info. Advanced Encryption Standard Galois/Counter Mode, better known as AES-GCM is a mode of operation for symmetric key cryptographic block ciphers that has been widely adopted because of its efficiency and performance. GCM supports authenticated encryption, meaning that the mode not only offers privacy, but also integrity.

Filter by
Sorted by
Tagged with
0 votes
1 answer
33 views

Length of SK_ei and SK_er in IKEv2 when using AEAD

I'm currently using strongSwan as a peer for the IKEv2 protocol. I've configured it to use HMAC SHA-256 for its pseudorandom function, and AES-256-GCM-16 for its encryption and integrity algorithm. ...
skeguest's user avatar
0 votes
0 answers
90 views

Cryptographic strength of AES-GCM-256 for classical and Quantum

How can the strength be calculated, of both the GMAC and the encryption for AES-GCM-256, with AES key of 256 bit, for classical and quantum computers?
Evgeni Vaknin's user avatar
0 votes
1 answer
60 views

Can I prove AES-GCM nonce reuse just from the bytes?

I have AES-GCM output with GMAC tag. The plaintext consists of some bitfields I know the structure of. When I generate input which should only affect timestamps and counters in very specific bytes, I ...
nusch's user avatar
  • 1
5 votes
1 answer
210 views

New NIST Journey: Accordion Cipher Mode

NIST recently unveiled the criteria for crafting a new block cipher mode of operation for AES called Accordion Cipher Mode. Simultaneously, they've announced Ascon as the Winner in the Lightweight ...
hardyrama's user avatar
  • 2,126
0 votes
1 answer
98 views

Do I need to use unique IVs if all encrypted data is unique?

I am designing a service where each user has both a unique 256-bit private and public ID. These IDs should be derivable from one another, but only within the backend of my service (as to not expose ...
Ryan Hilbert's user avatar
0 votes
1 answer
116 views

What exactly is RSA_WITH_AES256_CBC_SHA256?

Quick disclaimer, I am pretty new to cryptography. I only understand the basics of asymmetric and symmetric encryption. In particular, RSA and AES. I have a project where my service is receiving an ...
Aurelian Milleram's user avatar
0 votes
0 answers
76 views

What should be passed as the authentication tag when creating a SealedBox? And can it be made public?

When creating a SealedBox, one of the parameters which needs to be passed is an authentication tag: https://developer.apple.com/documentation/cryptokit/aes/gcm/...
sudoExclamationExclamation's user avatar
0 votes
0 answers
30 views

Seeking Guidance on Building Isomorphic Matrices for AES GCM in Composite Fields

I'm a beginner in cryptography, currently focusing on AES GCM, specifically the GF(2^128) multiplier which employs the irreducible polynomial x^128 + x^7 + x^2 + x + 1. I try to explore the ...
KAI's user avatar
  • 1
1 vote
1 answer
121 views

What does "192-bit equivalent" mean for WPA3?

In the Wikipedia page for WPA3 enterprise mode, it states that WPA3 has an "...equivalent 192-bit cryptographic strength in WPA3-Enterprise mode..." yet it also says that it uses AES-256-GCM ...
Maxthecat's user avatar
  • 111
1 vote
1 answer
126 views

Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit, why Not 2^39 [duplicate]

While examining the initial GCM specification by McGrew and Viega in 2005, it appears that the formation of the 128-bit Initialization Vector by combining a 96-bit nonce and a 32-bit unsigned wrapping ...
xyz's user avatar
  • 21
1 vote
0 answers
65 views

Weaknesses of AES-GCM [duplicate]

Besides the limited nonce size of 96 bits, are there any other weaknesses to the GCM mode of AES? I am creating a password vault and am trying to narrow down my options of encryption schemes. Also, is ...
Bismofunyuns's user avatar
0 votes
0 answers
48 views

Using AEAD as pure MAC with *only* associated data? [duplicate]

Authenticated Encryption with Associated Data (AEAD), such as AES-GCM, is a form of encryption that has a "built-in" integrity verification. This means that if the encrypted message is ...
pogoya9172's user avatar
0 votes
1 answer
89 views

Nonce reuse in GMAC without ciphertext (only AAD)

As we all know, nonce reuse in AES/GCM can easily be catastrophic. However, I'm wondering if the same risks are present if an adversary has access to: Ciphertext and corresponding MAC of one message ...
Julian Durchholz's user avatar
0 votes
1 answer
74 views

Can we have an asymmetric key in AES? Clarification about PBKDF2 and AES-GCM in WebCrypto

Can we have an asymmetric key in AES? Clarification about PBKDF2 and AES-GCM in WebCrypto According to wikipedia AES page, AES is a symmetric-key algorithm. The algorithm described by AES is a ...
borracciaBlu's user avatar
4 votes
0 answers
126 views

Masking countermeasures for AES-GCM

Suppose I have a masked AES encryption $AES(\oplus_i K_i, \oplus_i P_i)=\oplus_i C_i$, i.e. the key, plaintext, and resulting ciphertext are tuples $K_i$, $P_i$, and $C_i$ that sum to $K$, $P$, and $C$...
yoyo's user avatar
  • 420
0 votes
0 answers
89 views

Is it possible to uncover the plaintext if IV is used twice but the key is different?

I am currently working on a cryptography challenge. The program uses AES-GCM to encrypt and decrypt strings. Let's say I have the following: IV which is reused only 1 cipher text authentication tag ...
fdfdfd's user avatar
  • 101
0 votes
2 answers
291 views

ChaCha20-Poly1305 and AES-GCM-SIV output size

Background information: I need to encrypt 168bit messages, the ciphertext should, preferably, match the plaintext size. Message Authentication and Integrity is not a must, but a really important ...
Florebol's user avatar
2 votes
2 answers
1k views

Obsidian.md's "end-to-end" encryption & privacy

Obsidian.md claims End-to-end encryption means that the data is encrypted from the moment it leaves your device, and can only be decrypted using your encryption key once it's back on one of your ...
scr4tchy's user avatar
0 votes
1 answer
223 views

AES-GCM vulnerabilities

Does AES-GCM take replay attacks into consideration? If an attacker intercepts the AES-GCM secured message and gains access to the initialization vector (IV), can they inject falsely fabricated data (...
udit's user avatar
  • 1
0 votes
1 answer
80 views

AES-GCM across multiple packets

I am just getting started with cryptography. After doing some research, I see that people usually advice against encryption using the same key and nonce. However if a message is too long and has to be ...
Guest123456's user avatar
0 votes
1 answer
30 views

AES GCM representation of lev(IV) in IV padding to compute ICB

I have a question regarding understanding representation of length in AES-GCM while doing padding for the IV to calculate ICB/J0. In the aes GCM test vectors testcase5 I see the IV is of length 8 ...
sg777's user avatar
  • 367
0 votes
1 answer
93 views

Performance of AES NI using crypto++

I have following simple function ...
LWE-13's user avatar
  • 251
1 vote
1 answer
95 views

DTLS 1.2 Cipher Suites With AES-GCM – What data (if any) is passed to the AES-GCM cipher as the Additional Authentication Data?

It is DTLS 1.2 version question of this question. I know from 4.1.2.4. of RFC 5246 (DTLS 1.2) AEAD Ciphers can be used in DTLS 1.2 exactly the same with TLS 1.2. In TLS 1.2 AAD = seq_num + ...
Jounghoo Lee's user avatar
3 votes
2 answers
936 views

Encrypting arbitrary large files in AEAD chunks - how to protect against chunk reordering?

I would like to encrypt big files using an authenticated cipher. I am convinced to use approach where file is divided into smaller manageable chunks that fit easily in memory (e.g. 1-10MB size) which ...
Tom Raganowicz's user avatar
1 vote
1 answer
688 views

How does AES-GCM and AES-CCM provide authenticity?

My lecture notes state that of the AES operating modes ECB, CBC, CTR, CCM (CTR+CBC MAC) and GCM, only CCM and GCM provide authenticity. In CCM, as I understand it, the authenticity lies in the MAC, i....
user946822's user avatar
3 votes
1 answer
213 views

Does HMAC provide anything that AES GCM does not?

I would like to let the receiver has the ability to check the sender's authenticity when he gets the message. Also, I want to protect the message's confidentiality and integrity. Should I use ...
yaoxin jing's user avatar
1 vote
1 answer
203 views

Where in the TLS 1.3 record is the sequence number located?

The sequence number should be a 64 bit number in every TLS record, but the record header layer is only 5 bytes long and I am looking at a Wireshark pcap, where the TLS record only includes the header ...
miran80's user avatar
  • 123
0 votes
1 answer
53 views

Why is IV in RFC8448 examples only 12 octets instead of 16?

I am working on manual decryption of application data in TLS 1.3 by going through example in RFC8448. I successfully derived and expanded key and IV, but the IV in examples is only 12 bytes long ...
miran80's user avatar
  • 123
0 votes
0 answers
51 views

Question about Asymmetric key wrapping using (limited) AES-GCM

assuming that I have an RSA key of length 4k bit which I'm interested to wrap using AES-GCM, and I have a (limited) AES-GCM cipher which can only encrypt limited input in size (say 256-bit/512-bit ...
Rami's user avatar
  • 1
1 vote
0 answers
88 views

AES-GCM for sensitive database field - good solution?

I have been researching the best encryption to use in a .NET application for managing a sensitive database field (column). This encryption is on top of e.g. AWS at-rest encryption applied to the whole ...
MFL's user avatar
  • 11
1 vote
2 answers
188 views

decrypting full ciphertext of (AES CTR/GCM) based on partial knowledge of the cleartext

I have found myself in a position where I need to encrypt multiple objects (vCards) with AES Counter mode or Galois/Counter Mode using the same key. Now here is the problem the structure of the vCard ...
Tito's user avatar
  • 153
2 votes
0 answers
99 views

Safety of reusing same seed to derive secp256k1 keys and AES-256-GCM

The use case here is to deterministically generate a multi-use wallet from a single 12-word BIP39 mnemonic. Currently a standard process for deriving secp256k1 keypairs is implemented, e.g., using a ...
snsdgm's user avatar
  • 21
3 votes
1 answer
117 views

What kind of hashing is GF multiplication in GCM cipher mode and GMAC?

In GCM, GMAC, the additional associated data (AAD) (as well as outputs of subsequent blocks) is multiplied by a polynomial H in GF(2^128). This appears to be doing some secure hashing. Is that what's ...
zzazzles's user avatar
  • 117
2 votes
1 answer
343 views

Is it possible to reverse GHASH from GCM?

How can I create a "reverse" GHASH algorithm for GCM that allows me to compute an input value that generates a specific chosen output, given that I know the authentication key H? If this is ...
sWong's user avatar
  • 29
3 votes
1 answer
102 views

GCM-SIV vs CBC with fixed IV?

I keep hearing CBC with fixed IV mode is bad because it has similar issues to the codebook breakdown of ECB mode. However, people seem quite willing to recommend AES-GCM-SIV for deterministic ...
Paul's user avatar
  • 31
0 votes
1 answer
144 views

Implementing AES GCM but not getting correct output from cipher block

I'm implementing 128-bit AES-GCM (but only the encryption/AES-CTR aspect). When I set the Secret Key, Plaintext and IV to Test Case 2, page 27 of the GCM spec (see below) I get the wrong value for the ...
user997112's user avatar
0 votes
1 answer
138 views

AES GCM Difference between the IV and the Secret Key?

Below is part of AES GCM diagram. However, it only shows the behavior of the IV/counter. The GCM specification examples state both an IV and a Secret Key as two inputs. Can someone please explain ...
user997112's user avatar
1 vote
1 answer
97 views

Drawbacks of multiple sources of entropy for AES

Since AES needs IV to be random (unless fed by a unit test), I was wondering how to properly handle it. I know that Intel/AMD now supports the rdrand64 function but ...
Niels's user avatar
  • 23
1 vote
1 answer
423 views

AES256-GCM padding for unaligned blocks

So I found some test vectors for my SSE implementation of AES256-GCM and unfortunately it seems that after the last step of AAD it goes wrong. My guess is that this is because the AAD is actually ...
Niels's user avatar
  • 23
4 votes
2 answers
2k views

OpenSSL AES-GCM says 'bad decrypt', other block modes work fine?

If I do a simple encrypt and decrypt test like so: ...
RocketNuts's user avatar
  • 1,387
2 votes
1 answer
967 views

AES-GCM with HMAC

I am using AES-GCM to encrypt some data. I want every encryption to be done with a new random iv. For every encryption a new iv is generated and appended to the encrypted text to produce the cipher. ...
LUMPAAK's user avatar
  • 21
2 votes
1 answer
2k views

Understanding AES-GCM IV (Nonce), Tag/MAC, Message & Transmission

I am working on a project that uses PAKE (SRP) for authentication. When we send the M1 to the server we are encrypting the payload using AES-GCM. I mention SRP only to set the context: A message is ...
Joseph's user avatar
  • 123
2 votes
1 answer
1k views

What does AES-GCM provide?

I am wondering does AES-GCM which uses Authenticated Encryption provide us with all 3 properties (Authenticity, Confidentiality, and Integrity), or does it not provide integrity?
CryptoGuru's user avatar
2 votes
1 answer
1k views

How long does it take to decrypt AES encrypted message with salt(for pbkdf2 key) and iv known

I'm new to crypto! The situation is, Aes-256-cbc encrypted message(including not encrypted iv & salt) is revealed. We also know pbkdf2 function uses 10000 rounds with sha256. All we need to ...
Hyunhum's user avatar
  • 33
1 vote
0 answers
62 views

Should I encrypt individual columns or all data?

I want to AES-GCM some user data that I‘m going to persist in a database. I‘m wondering if I should encrypt individual columns (all with an individual IV ofc) or JSON stringify the sensitive data and ...
lenny.myr's user avatar
  • 111
0 votes
0 answers
300 views

Decryption failure for NIST vector AES-CBC-128

I am learning/exploring the openssl library for encrypting and decrypting data while encryption goes through fine I see standalone decryption not working as I expected. The test vector I am using is <...
Eddy's user avatar
  • 1
1 vote
1 answer
438 views

How are long IVs used in AES-GCM?

I looked through NIST's official test vectors (CAVP) for the AES-GCM mode, and noticed that there are some test vectors in there with 8-bit or 1024-bit IVs. But as far as I understand, the GCM ...
polfosol's user avatar
  • 201
0 votes
1 answer
1k views

What is the use of Additional data or associated data in AESGcm. How it is used while encryption and decryption [closed]

I am trying to understand the AESGcm encryption and decryption and there's one field associated data in Encryption and Decryption methods. https://learn.microsoft.com/en-us/dotnet/api/system.security....
Captain_Levi's user avatar
1 vote
0 answers
105 views

Using a signature as key material

I am designing my first web3 app and I would like to use MetaMask as an identity and crypto provider. My web3 app will encrypt user data with AES-GCM, but I do not want to generate and store an ...
pinebitter's user avatar
1 vote
1 answer
104 views

Is MAC unnecessary for client side encryption?

In my open source with offline client side encryption application, I plan to use AES-CTR or ChaCha20 without MAC instead of GCM or Poly1305 since: There is no database, the ciphertext, nonce, tag ...
Kim Mỹ's user avatar
  • 165

1
2 3 4 5