Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [aes-gcm]

Deprecated tag, see tag info. Advanced Encryption Standard Galois/Counter Mode, better known as AES-GCM is a mode of operation for symmetric key cryptographic block ciphers that has been widely adopted because of its efficiency and performance. GCM supports authenticated encryption, meaning that the mode not only offers privacy, but also integrity.

Filter by
Sorted by
Tagged with
0 votes
1 answer
27 views

AES GCM mode - what is ouput in that scheme?

I'm trying to understand that scheme: https://xilinx.github.io/Vitis_Libraries/security/2019.2/guide_L1/internals/gcm.html Here on page 11 it looks like GHASH gives only one value "Return $Y_m$&...
user avatar
  • 959
2 votes
1 answer
37 views

Validating AES GCM authentication tag between two different implementations

I'm a bit confused on how to validate the authentication tag between two different AES GCM implementations. One implementation (on my part) is in Java. The other, I don't know. In my implementation, ...
user avatar
1 vote
0 answers
70 views

How fast is GHASH and what does it do?

I read here: https://www.researchgate.net/publication/220335697_GCM_GHASH_and_Weak_Keys how GHASH works. So we have $m$ 128-bit blocks $X_{i}$ and we compute in $GF(2^{128})$: $Y_{m} = \sum_{i=1}^{m} ...
user avatar
  • 959
0 votes
1 answer
95 views

Is AES GCM with PBKDF2 100k iterations still ok as of 2022?

Is using AES GCM with PBKDF2 and 100 000 iterations still considered secure as of 2022? In our threat model, if we ignore the risks linked to quantum computing, is this secure? Here is an example ...
user avatar
  • 481
1 vote
1 answer
41 views

Clarification on nonce collision calculation

I've been working on a AES256-GCM implementation (in Java). I'm a little bit stuck on the part where i need to decide how often i need to rotate my key. I've got a lot of information from this posts: ...
user avatar
1 vote
1 answer
40 views

some questions about IPSEC ESN

ESN feature is described in RFC 4303. Here is some questions which bothered me: When use ESN combined with AES_GCM or AES_GMAC alogrithom, do I need to add the high-order ESN bits to the packets? ...
user avatar
  • 11
1 vote
1 answer
63 views

Multiple Encryption Using GCM For Multi-Key Security

Multiple Encryption For Multi-Key Security I have a hypothetical question about multiple encryption after reading Matthew Green’s blog on multiple encryption. For those who are familiar with GCM…I ...
user avatar
  • 11
1 vote
1 answer
101 views

Is AES GCM without GMAC vulnerable against known plaintext attack?

Is AES GCM without GMAC vulnerable against bit-flip attacks? Let's assume the plaintext is known for some reason (e.g. it can be guessed). In my opinion, I can flip bits in the ciphered blocks and can ...
user avatar
  • 1,427
0 votes
0 answers
141 views

AES256-GCM Is it safe to both add the IV to the AAD and use it in the encryption?

I'm looking at a protocol which adds the IV (used for the encryption) into the AAD. If the IV (which is part of the message) was incorrect, decryption would fail anyway. Why is it useful to add the IV ...
user avatar
  • 701
1 vote
1 answer
129 views

Is it possible to partially decrypt an aes-gcm ciphertext?

Say that I encrypt a large file using aes-gcm and upload it somewhere. Can I then download only the first few blocks (as well as IV and tag) and decrypt them? If not, is there another authenticated ...
user avatar
  • 411
4 votes
1 answer
160 views

Is GCM with zero-length AAD less secure?

In a previous question, it was made clear that in the case of GCM, there is no distinction between "no AAD" and "zero-length AAD". Since I have noticed "zero-length AAD" ...
user avatar
  • 161
-1 votes
1 answer
102 views

What would be the benefits of using a faster cryptographic system with the same level of security as AES

Essentially I'm asking, what if I have designed a quantum-proof stream cipher that is faster than AES-256? Will using less computational power for encryption/decryption be valuable to companies or ...
user avatar
1 vote
0 answers
31 views

How safe is store nonce with encrypted text? [duplicate]

I am using AESGCM256 with a nonce of 96 bytes to store keys (very secret information). There are more than 500 keys, the only place where they can be stored in ...
user avatar
0 votes
1 answer
281 views

AES-GCM encryption in .NET Core

I created a crypto service using AES-GCM in order to encrypt the sensitive data in database. Firstly, I'm generating a cryptographic key from a password (probably will be stored in Kubernetes Secrets) ...
user avatar
0 votes
1 answer
68 views

Security level of Poly1305 and GMAC

The Libsodium docs list the AEAD forgery limits for ChaCha20Poly1305 and AES-GCM which seems like a < 128-bit security level but says that it's not a practical concern. I've seen other people say ...
user avatar
1 vote
1 answer
113 views

API key generation technique

I am designing an web api which needs to grant access to various client apps via an api key sent as http header. I know, not really how it should be done but I have no control over this part. My ...
user avatar
  • 11
2 votes
2 answers
303 views

FOR AES GCM decrypt function, Does the output(PT) depend on Tag value(T)?

According to spec, FOR GCM decrypt function input is IV, A, C, and T. As mentioned below: 5.2.2 Authenticated Decryption Function Given the selection of an approved block cipher, key, and an ...
user avatar
2 votes
1 answer
102 views

What benefit is gained when combining AES GCM/GMAC with ECDSA?

This is a real world question (and as I'm not an expert in cryptography I have only some basic knowledge in terms of just using it, not a deep understanding how ist works under the hood.): A system ...
user avatar
  • 1,427
0 votes
1 answer
63 views

What is the term to describe the combination of ciphertext, IV and authentication tag?

Authenticated encryption with associated data, such as AES-GCM, will take as input: IV, optional associated data, plaintext and key. A ciphertext and an authentication tag will be produced. Is there a ...
user avatar
  • 2,613
2 votes
1 answer
110 views

Can the AES-GCM authentication tag be used as a key derivation function?

I want to build a deterministic key derivation tree, where the root is stored securely in a centralized service and the leaves are embedded in a multitude of devices. When a device wants to ...
user avatar
  • 472
3 votes
1 answer
105 views

Factorization of polynomial in GF(2^128) used in GCM

It is widely known, that using a GCM nonce twice or even more often can be used to disclose the authentication key H. I understand, why this is theoretically possible. However, I have no feeling about ...
user avatar
  • 1,427
1 vote
1 answer
214 views

Why using same nonce (IV) twice voids confidentiality of plain text or even key?

I understand roughly (without details of GF algebra) the scheme of GCS/GMAC: IV is to be put into Counter-0, so initializing counters. It is known, that using a IV twice can not only reveal the plain ...
user avatar
  • 1,427
0 votes
0 answers
101 views

How to protect a non-extractable Secret Key in indexedDB?

I have encrypted data in AES-GCM with the crypto API. The initialisation vector is then ...
user avatar
  • 101
0 votes
0 answers
69 views

Proper implementation AES-256 for single block E_k then being used on AES-GCM

My first objective is to implement AES-GCM in PowerShell 5.1 since there is not an implementation that not use external dll libraries. According to the GCM schema of encryption: the E_k block should ...
user avatar
1 vote
0 answers
35 views

Does my asymmetric/symmetric mixed file encryption pseudo code pass sanity check?

I realize this depends on my implementation and the implementation of the libraries I use. I am asking about my process assuming that the encryption libraries and my code are not flawed/compromised, ...
user avatar
  • 123
-1 votes
2 answers
2k views

Special characters in AES Encryption Key

We all know that AES uses Key, IV and salt. But what if we add special ASCII characters like Alternate 255 (" ") or Alternatively 163 ("£") or Alternate 224 ("α") in the ...
user avatar
  • 3
1 vote
0 answers
134 views

Constructing an XChaCha20-Poly1305 Equivalent using FIPS-140 Primitives

I am playing around with the idea of modelling clustered data storage as a series of AEAD messages. XChaCha20-Poly1305 has nice properties for my intended design, as the ability to use random IVs ...
user avatar
  • 111
0 votes
2 answers
223 views

what is auth data in AES-GCM

I am trying to understand AES-GCM and I do not understand what I should transmit to Auth Data during encryption. What kind of data is that?
user avatar
3 votes
1 answer
81 views

Using keys as Additional Authentication Data in GCM

In my opinion, it's not a good idea to use (symmetric/asymmetric) keys as Additional Authentication Data (AAD) in GCM as AAD is only authenticated but not encrypted. The key will be protected from ...
user avatar
  • 31
1 vote
1 answer
80 views

Cipher Text generated is different if nonce is greater than 12 bytes

I wrote a library which uses AES-GCM-128 to perform encrypt and decrypt operations. This library uses EVP functions that provide a high level interface to OpenSSL cryptographic functions. To verify my ...
user avatar
1 vote
3 answers
269 views

What's the preferable encryption for large data and files in terms of speed and security other than AES?

First of all, I'm relatively new to encryption so please bear with me. I'm looking for a way to encrypt large amounts of data only on my device, no need to transfer my encrypted files/data (10-20GB or ...
user avatar
1 vote
0 answers
62 views

Usage of block and stream ciphers

I see that in many applications stream ciphers are common than block cipher - whether is Salsa20, AES-GCM, etc. In which cases would a stream cipher be preferred over a block cipher and vice versa? ...
user avatar
  • 21
1 vote
2 answers
365 views

Stream cipher and block cipher usage in network data encryption

Stream ciphers are usually used for streaming data encryption, such as voice, and also for low layers data encryption. For example, MACSec uses AES-GCM encryption. In L3 ad L4 security protocols (...
user avatar
  • 21
3 votes
1 answer
197 views

Is a stream cipher and a (cryptographically secure) PRNG nearly the same thing?

If I let the authentification tag aside (which is important), encrypting with AES-GCM and a fixed key and nonce: ...
user avatar
  • 481
1 vote
2 answers
955 views

Encrypt a big file in blocks with AES-GCM: how many nonce do we need?

I need to encrypt big files using AES-GCM, potentially 10 GB or more. For memory (RAM) reasons, I need to processs them by blocks (let's say 16 MB), rather than doing ...
user avatar
  • 481
0 votes
2 answers
63 views

How to be able to change the password to access data encrypted with AES-GCM, without reencrypting?

Let's say you need to encrypt plaintext which is 1 TB big. You have a password pwd. This very classical AES-GCM process is ...
user avatar
  • 481
2 votes
1 answer
189 views

How to encrypt many files with AES-GCM, without running the key derivation function each time?

Linked question: AES encrypting multiple files With a password, I have 100k files to encrypt. (Maybe 100k files today; or maybe 50k today, 10k tomorrow, and 40k ...
user avatar
  • 481
1 vote
2 answers
144 views

Using different hashing function with ECDSA

I came across an IC device configuration & security flow and the details are illustrated in image below. I'm wondering must the ECDSA pair with the SHA Hashing function? Alternatively, what if ...
user avatar
  • 61
2 votes
0 answers
411 views

Why does CNG only (seem to) support FIPS-approved AES-GCM decryption but not encryption?

The Security Policy Document: Microsoft Windows FIPS 140 Validation (version 1.4 dated May 7, 2020) mentions in section 2.2: 2.2 FIPS 140-2 Approved Algorithms Cryptographic Primitives Library ...
user avatar
0 votes
1 answer
289 views

Consequences of AES-GCM always encrypting the same plaintext

I am analysing an authentication protocol. In this protocol AES-GCM is used to encrypt part of the messages. Regarding the authentication protocol, I made the following observations: The plaintext ...
user avatar
  • 31
5 votes
1 answer
268 views

The Rationale behind NIST's counter/LFSR recommendation on deterministic IV constructions on SP 800-38D

The NIST has a "SP 800-38D: Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC". This guideline is a base for AES-GCM from definition to security ...
user avatar
  • 43.1k
9 votes
1 answer
2k views

What are the rules for using AES-GCM correctly?

When using AES-GCM I know that I am supposed to use a new initialization vector every time I call the AES-GCM algorithm with the same key. What are other rules must be followed to use AES-GCM ...
user avatar
  • 461
2 votes
3 answers
1k views

Can AES GCM mode detect an incorrect key and refuse to decrypt?

I understand that AES in GCM mode produces an authentication tag that is used to ensure that a tampered with cipher text is not decrypted. However, if I pass the wrong key will AES in GCM mode detect ...
user avatar
  • 461
4 votes
1 answer
892 views

What is Associated Data in AEAD?

I am trying to understand what is AEAD exactly. I am application developer not a cryptographer. I have been searching online for a while watched a bunch of Youtube videos, read through a couple of ...
user avatar
  • 461
1 vote
1 answer
93 views

Number message limits of Galois/Counter Mode (GCM) per key

In https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf page 27, it is said that ...the total number of blocks of plaintext and AAD that are protected by invocations of the ...
user avatar
  • 73
3 votes
2 answers
241 views

Extending AES-GCM initialization vector

We all know that applications of crypto primitives like to not think about the management of nonces, and initialization vectors and often prefer to just set them to random values. This sometimes leads ...
user avatar
  • 1,105
3 votes
0 answers
65 views

How is the time intereval calculated for symmetric key re-negoatition in UK Security Standard – Use of Cryptography?

According to point 10.6.4 (Encryption in Transit) in Security Standard –Use of Cryptography, one of the criteria for key renegotiation is timeout , Encrypted sessions MUST re-negotiate new symmetric ...
user avatar
  • 1,980
2 votes
2 answers
2k views

AES-GCM: Verification before Decryption

I am looking at ChaCha20Poly1305 WolfSSL. It is noted that the ChaCha20Poly1305 AEAD construction has the property, that it only outputs the plaintext, if the verification of the MAC (Authentication ...
user avatar
  • 121
2 votes
1 answer
228 views

The Security of AES-N-GCM

In the paper The Security and Performance of the GaloisCounter Mode(GCM) of Operation,it shows the AES GCM SECURITY in Corollary 1. there are no distinguishing attacks against AES-N-GCM that work ...
user avatar
  • 21
4 votes
1 answer
2k views

Proper way of encrypting large files with AES-256-GCM

I would like to encrypt and decrypt files with AES-256-GCM. I need a solution that works with Java, PHP and JavaScript. In practice, users can upload, download files via web browser and/or desktop app ...
user avatar
  • 141