Questions tagged [aes-gcm]

Deprecated tag, see tag info. Advanced Encryption Standard Galois/Counter Mode, better known as AES-GCM is a mode of operation for symmetric key cryptographic block ciphers that has been widely adopted because of its efficiency and performance. GCM supports authenticated encryption, meaning that the mode not only offers privacy, but also integrity.

Filter by
Sorted by
Tagged with
0
votes
1answer
36 views

Consequences of AES-GCM always encrypting the same plaintext

I am analysing an authentication protocol. In this protocol AES-GCM is used to encrypt part of the messages. Regarding the authentication protocol, I made the following observations: The plaintext ...
5
votes
1answer
63 views

The Rationale behind NIST's counter/LFSR recommendation on deterministic IV constructions on SP 800-38D

The NIST has a "SP 800-38D: Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC". This guideline is a base for AES-GCM from definition to security ...
4
votes
1answer
160 views

What are the rules for using AES-GCM correctly?

When using AES-GCM I know that I am supposed to use a new initialization vector every time I call the AES-GCM algorithm with the same key. What are other rules must be followed to use AES-GCM ...
2
votes
3answers
166 views

Can AES GCM mode detect an incorrect key and refuse to decrypt?

I understand that AES in GCM mode produces an authentication tag that is used to ensure that a tampered with cipher text is not decrypted. However, if I pass the wrong key will AES in GCM mode detect ...
0
votes
0answers
22 views

How to perform encryption/decryption in a RESTful system? [migrated]

I'm not a crypto/security expert and have designed an architecture for encryption/decryption. I'm not sure if its full proof and want to know what people use as industry standard? I'm trying to ...
1
vote
1answer
47 views

What is Associated Data in AEAD?

I am trying to understand what is AEAD exactly. I am application developer not a cryptographer. I have been searching online for a while watched a bunch of Youtube videos, read through a couple of ...
1
vote
1answer
39 views

Number message limits of Galois/Counter Mode (GCM) per key

In https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf page 27, it is said that ...the total number of blocks of plaintext and AAD that are protected by invocations of the ...
0
votes
0answers
31 views

Java large file AES Encryption is very slow [migrated]

I'm trying to encrypt a 512 Mb file with AES/CBC algorithm. It is taking around 7 sec which is too much. How to reduce the encryption time and make it faster. I'm using a fixed key and tried using ...
2
votes
2answers
101 views

Extending AES-GCM initialization vector

We all know that applications of crypto primitives like to not think about the management of nonces, and initialization vectors and often prefer to just set them to random values. This sometimes leads ...
0
votes
0answers
18 views

Encrypting Sectors of MiFare Plus SE

I am trying to have some MiFare Plus SE cards manufactured but I was told that I need to give instructions on the HMAC encoding method, as shown in the image, which I understand and have done, but ...
3
votes
0answers
49 views

How is the time intereval calculated for symmetric key re-negoatition in UK Security Standard – Use of Cryptography?

According to point 10.6.4 (Encryption in Transit) in Security Standard –Use of Cryptography, one of the criteria for key renegotiation is timeout , Encrypted sessions MUST re-negotiate new symmetric ...
2
votes
2answers
278 views

AES-GCM: Verification before Decryption

I am looking at ChaCha20Poly1305 WolfSSL. It is noted that the ChaCha20Poly1305 AEAD construction has the property, that it only outputs the plaintext, if the verification of the MAC (Authentication ...
2
votes
1answer
168 views

The Security of AES-N-GCM

In the paper The Security and Performance of the GaloisCounter Mode(GCM) of Operation,it shows the AES GCM SECURITY in Corollary 1. there are no distinguishing attacks against AES-N-GCM that work ...
0
votes
1answer
249 views

Proper way of encrypting large files with AES-256-GCM

I would like to encrypt and decrypt files with AES-256-GCM. I need a solution that works with Java, PHP and JavaScript. In practice, users can upload, download files via web browser and/or desktop app ...
0
votes
1answer
119 views

TLS 1.2 AES-GCM decryption problem

I'm trying to decrypt a PCAP encrypted with TLS 1.2. I have the private key and Wireshark is able to decrypt the data so what I am doing should work but there is obviously something wrong. The ...
0
votes
0answers
30 views

Are there popular and secure Authenticated Encryption schemes with Salsa20/Sosemanuk in CTR-mode with a Carter-Wegman MAC?

I read that AES/GCM is a good choice for authenticated encryption because: AES has very strong heuristic security Encrypt-then-MAC leaks no information about the plaintext The CW-MAC in GCM can be ...
0
votes
0answers
72 views

Requirements for AES-GCM Initialization Vector (IV)

AES-GCM requires a different Initialization Vector (IV) for every new stream of data that is encrypted using the same key. TLS generates the IV by XOR-ing a random static nonce (generated from the ...
0
votes
2answers
51 views

AES ECB deterministic encryption to perform Private set intersection

There are two parties, and each has a list of plain-texts. My end goal is to assign indices to unique plain-texts across both parties. My present approach is the following. Both parties perform a ...
0
votes
1answer
53 views

Does the authentification in GCM serve the same purpose as CRC32?

The purpose of the authentification is to ensure the data integrity. Let's just focus on the authentification part of the GCM which is using the Galois field multiplication to create an ...
1
vote
1answer
54 views

Nonce of AES-GCM generated by Counters

i am trying to generate the nonce for AES-GCM. I know people usually generate it by Counters and LFSRs. I am confused about the meaning of Counters. Is that means Counter (CTR)? Why it can generate ...
1
vote
1answer
84 views

Safe way to derive IV from the DH shared keys for AES-GCM?

I am preparing to use AES-GCM to make a secure communication program. Here is the procedure DH key exchange to get shared keys SHA256(shared keys) Use AES-GCM to encrypt a message while the key only ...
1
vote
2answers
183 views

Can an AES-GCM be cracked if the key is known but the nonce isn't?

I'm kind of new in this field and I've been trying to learn it. I'm now facing an issue where I have a couple of packages encrypted with AES-128 GCM and I have the key that was used to encrypt these ...
2
votes
2answers
144 views

Size of IV in AES-GCM according to RFC 4106

RFC 4106 specifies about nonce. It contains a salt of size 4 octets and an iv of size 8 octets. Further, RFC specifies that salt is assigned at the beginning of the security associations which is ...
1
vote
1answer
262 views

Using AES-GCM (or AEAD ciphers in general) as a pure MAC without encryption

What's the opinion on using an AEAD cipher such as AES-GCM for example as a pure message authentication code (MAC) when only message authentication but not encryption is required. does it bring any ...
2
votes
1answer
2k views

Why GCM operation mode with AES-128 is recomended and can we use AES-192 and AES-256 with GCM?

It happens that on the internet I often find that AES encryption should use a 128-bit key only if it is used in conjunction with the GCM mode of operation. Why only with 128-bit keys? What happens ...
1
vote
0answers
63 views

Store symmetrical (AES) key in Indexeddb?

Using web crypto API and it won't let me store an AES key in the indexeddb (it requires a public/private key). Does anyone have suggestions on how to do this? Should I/could I create a public/private ...
0
votes
1answer
315 views

Why AES 256 GCM is more preferred by email service providers / banks over the fast and efficient ChaCha20 - Poly1305?

This question is based on my recent observation of preferences of certain email service providers and banks to use AES related symmetric ciphers over the more fast ChaCha20 Poly1305 . For example ...
1
vote
0answers
99 views

AES-GCM - what are “Payload Length” and “AAD Length”

For the AES-GCM mode within many cryptomodules, their FIPS-validation certificates list the options: Payload Length: 504, 512, 1016, 1024 AAD Length: 0, 504, 512, 1016, 1024 For example in OpenSSL, "...
2
votes
0answers
310 views

What are the popular modes-of-operation (AES-GCM, AES-SIV, AES-GCM-SIV, etc.) geared for?

I'm interested in developing software capable of encrypting personal files (which will ultimately be backed up to the cloud) and have been doing my best to follow best practices. There are many forms ...
0
votes
1answer
108 views

Asymmetric or Symmetric encryption

I'm currently looking into OpenSSL and its API and I'm not really familiar with cryptography. So I was looking at the example on asymmetric encryption of an envelope. And it says the message is ...
2
votes
3answers
4k views

How to encrypt files using AES256-GCM cipher under Linux? [closed]

I'm struggling to implement AES256-GCM on a Linux machine to encrypt files outgoing to another party. We're usually exchanging files using PKI, but this particular party insists on AES256-GCM and ...
0
votes
2answers
130 views

If all encrypt algorithms in TLS1.3 ciphersuites are AEAD , why do they keep including a Hash algorithm?

In TLS1.3 all allowed algorithms included in cipher suites are AEAD, which means they don't just encrypt but they authenticate too (thus if I don't misunderstand, they give not only confidentiality ...
0
votes
2answers
146 views

Does HMAC provide anything that AEAD does not?

Alice and Bob have to talk through Eve. (server to device through untrusted third party that relays messages, no TLS available) Assume a secure key. Out of scope. Example, ECDH key exchange with HKDF....
1
vote
2answers
350 views

AES 256 CBC - Storing local data, how to save IV vector?

I want to use AES256 CBC for protecting small data (<100kb) against misusage for my application in the local store folder. I'm not an expert at data encrypting so I'm to try to understand it step ...
0
votes
1answer
67 views

Is encryption with the Web Cryptography API resistant against side channel attacks?

If I want to encrypt some payload with AES-GCM, with the Web Cryptography API, how resistant would this be against side channel attacks?
1
vote
1answer
294 views

How can AES-CCM behave as an AEAD stream cipher?

AESCCM- Couter with Cipher Block Chaining Message. As it uses cmac for generation for tag , which is internally aes-cbc (block cipher, need block size, may require padding) And Encryption is done ...
3
votes
2answers
656 views

What are the actual merits of Galois/Counter Mode?

GCM (Galois/Counter Mode), in particular in combination with AES, has been a de-facto gold standard for years. Encrypt and authenticate in one step, that's just too awesome, and terms like AEAD work ...
2
votes
1answer
213 views

Key derivation for AES-GCM using HKDF?

I have a system comprising N >1000 nodes. At each node I would like to use HKDF to derive a unique 256-bit key, Kn (for the nth node), from a pre-shared master key, K0, and a locally-generated random ...
3
votes
1answer
266 views

Why can't AES-GCM be used in IKEv1 phase 1?

I was configuring a VPN on a firewall (fortigate) and realized that I could use AES-GCM for encryption in the IKEv1 phase 2 but not in the phase 1 and I was wondering why knowing that in IKEv2 we ...
0
votes
1answer
67 views

Can I use a fixed IV with AES-GCM if I only encrypt unique plaintext values? [duplicate]

My use case guarantees that all plaintext values are unique. In this case, is it safe to use a fixed IV with AES-GCM to carry our encryption/decryption?
0
votes
1answer
156 views

Is the AES-GCM encryption using the SHA256 hash of the plaintext as IV secure?

I want to encrypt a list of unique values and I want the property of when I encrypt the same value I get the same ciphertext (determinism). The adversary only observes the ciphertexts of a unique set ...
4
votes
1answer
296 views

Why doesn't GMAC/GCM encrypt its authentication tag?

As most know, a duplicate nonce with GMAC/GCM allows key recovery attacks against GMAC itself and thus the ability to forge messages. This is because GMAC computes GHASH and then just XORs this with ...
3
votes
1answer
147 views

What if an AES GCM nonce overflows and collides with the GHASH nonce (0^128)?

When using AES in GCM mode, the GHASH function uses E(0^128) as the initial value for H, the authentication key. The IV, for the underlaying CTR mode, is initialized with: [prefix (application nonce)]...
1
vote
1answer
88 views

Decrypt authenticated cipher while still encrypting [duplicate]

Normal AES-GCM generates an authentication tag at the end of encryption. I want to decrypt it while it is still being encrypted. This would be useful to send, encrypt, receive and decrypt a large file ...
0
votes
1answer
209 views

Do I still need SHA256 if I already had a AES 256 key that is 44 characters long?

Several months ago, I was required to research on AES and SHA-256 to make a secured license system for my app. However, I was dumb enough that couldn't distinguish between the 256 bits from AES and ...
1
vote
2answers
246 views

Plain text size limits for AES-GCM mode at 2GB with Sun JCE implementation?

The Sun JCE implementation of GCM is hard coded to refuse to encode more than 2 Gb, through the function GaloisCounterMode.checkDataLength() that returns an error message : "SunJCE provider only ...
1
vote
1answer
152 views

Encrypting more than ~64GiB with AES-GCM - Integrity

I'm looking for solution to encrypt more than acceptable limit ~64GiB under same key with AES-GCM. I know I'm obligated to exchange nonces for each next ~64GiB chunk, but there is one thing that is ...
0
votes
1answer
488 views

Apple CryptoKit - Understanding its portability

I've been playing with Apple's CryptoKit (their effort to make their old CommonCrypto lib more modern and easy to use via Swift, their programming language). I'm interested to see how portable it is.....
1
vote
2answers
395 views

How to implement correctly an Integrated Encryption Scheme?

I am developing a REST client (from an Android Point Of Sale) where I'm given a public RSA 2048-bit key and I need to encrypt transaction information. Since that single block cannot be encrypted (and ...
8
votes
3answers
2k views

Can a zero nonce be safely used with AES-GCM if the key is random and never used again?

I could generate a random nonce and prepend it to the ciphertext, but storage space is at a premium and the only constraint AES-GCM has on the nonce (if I'm reading correctly) is that the same nonce ...