Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Advanced Encryption Standard Galois/Counter Mode, better known as AES-GCM is a mode of operation for symmetric key cryptographic block ciphers that has been widely adopted because of its efficiency and performance. GCM supports authenticated encryption, meaning that the mode not only offers privacy, ...

0
votes
1answer
39 views

Encryption / Decryption using AES-256 GCM

I am new in cryptography and I am facing some complications in encryption-decryption. I am trying to use AES-GCM with a 256-bit AES key and a 96-bit nonce. I use an open source project (Vault) to ...
1
vote
1answer
70 views

Key generation for AES-GCM-256 file encryption

I am currently working on a file encryption software that works via AES-GCM-256 and I am looking for feedback on the encryption key generation process I intend to implement. So far, I have come up ...
2
votes
1answer
84 views

AES - which cipher is the safest one out there and what are the best practices for creating and storing the key

I just started to learn cryptography. I've read a ton of articles but couldn't find a book or a course that is based on this subject (and also is not outdated). Therefore I have a few questions (...
2
votes
1answer
22 views

Is using derived keys for HKDF + AES-GCM safe

I have an existing system which takes a cryptographically secure BLOB from user and pass it to lower API which calls HKDF-Expand to get 2 keys: one is effectively discarded in this scenario and second ...
2
votes
1answer
24 views

What would be an adversary advantage in case of GCM authentication?

Philip Rogaway has written a formula for CCM mode where the adversary advantage is given as: $$adversary\_advantage \leq \frac{q_{dec}}{2^t} + \frac{\sigma^2}{2^b}$$ Can we use this formula to find ...
0
votes
1answer
67 views

AES-GCM GHASH calculation;

I'm trying to make an GHASH() function and need some clarification. Implementation is based on gcm-spec. Page 8 describes polynomial mult and page 27 has a "Test Case 2" which I use to verify result. ...
2
votes
1answer
54 views

Real time video stream AES encryption with authentication

I am now studying the AES encryption for real-time video stream. It seems that Netflix uses the AES-GCM (or CBC + MAC) mode for real-time video encryption and authentication. With MAC authentication, ...
0
votes
2answers
88 views

AES-GCM conformance test

Is there any conformance tests/sequences to validate AES-GCM & GHASH() implementation? Details: I'm implementing AES-GSM, that's just for better understanding of that stuff, nothing more. Well I ...
2
votes
1answer
47 views

GCM mode of operation and IV size less 96 bits

GCM specification defines the initial counter value $Y_0$ for encryption/decryption operations as follows: $$ Y_0=\begin{cases} IV||0^{31}1 &\text{if len}(IV)=96\\ GHASH(H,\{\},IV)& \text{...
0
votes
2answers
60 views

Is it safe to use a counter as IV for AES256-GCM

What if I will use 96-bit integer counter starting from 0 as IV for AES256-GCM cipher. Is it safe? Is there any other ways to ensure uniqueness of IV for GCM cipher?
1
vote
2answers
65 views

Is the key safe if attacker know the encrypted and decrypted message?

Given an attacker know both the encrypted message (+ an iv) and the equivalent decrypted message, is it possible for him to craft a new encrypted message that could result in a desired decrypted ...
2
votes
1answer
78 views

Why is GCM not vulnerable at the birthday bound for 128 bit IV?

According to this article, which looks at attacks on Caesar candidates beyond what they claim, they include an attack on page 6 for nonce-respecting adversaries for AES-GCM which allows IVs longer ...
1
vote
1answer
55 views

It's safe to store a known value (for checking) next to the actually encrypted values

The high level details of the encryption I'm using is: AndroidKeyStore create/store RSA key AES key is created and wrapped with RSA/ECB/PKCS1Padding Encrypted AES is saved to disk. Data is encrypted ...
0
votes
1answer
50 views

Good practices for AES key derivation and management

I'm developping a device based on STM32L4x6. It is connected through BLE to a smartphone and it exchanges encrypted data with it. Data consists of health data of patients. Encryption is AES-GCM 256 ...
0
votes
2answers
139 views

Which is slower, AES or GCM hash (GHASH), if CPU has no special instructions?

In an answer to this question: Security of GCM if Implemented with Stream Cipher instead of Block Cipher ...it was stated that: The GHASH part of GCM is usually the problematic one when it comes to ...
7
votes
1answer
349 views

TLS 1.2 Cipher Suites With AES-GCM – What data (if any) is passed to the AES-GCM cipher as the Additional Authentication Data?

TLS 1.2 defines a number of cipher suites that employ AES-GCM, e.g.: ...
0
votes
1answer
89 views

Key wrapping - encrypting many times with AES-GCM

When encrypting many short plaintexts with a single key, lets say about 2^70 total plaintexts at under 64 bytes each: Is there a way to use AES-GCM, as specified by NIST Special Publication 800-38D, ...
1
vote
1answer
28 views

Will AES-GCM smaller sized tag (mac) be included in larger sized tag

I want to make sure that I understand AES-GCM correctly: If I have: key1, plaintext1, iv1, adata1 and requset tag size of 96 bits, and tag size of 128 bits, will the first 12 bytes of the 128 bits ...
0
votes
2answers
288 views

Appropriate key for AES 256 GCM

I am updating a system that has Rails' OpenSSL on one side and Python's cryptography.io on the other. The Rails side has to generate keys for the AES-256-GCM and here are two methods that appear to ...
8
votes
2answers
1k views

Can AES-GCM be broken if initialisation vector is known?

We are using AES encryption in GCM block mode in order to encrypt a number of different kinds of data at rest on a mobile device - Android. The key used for encryption is stored in the protected key-...
0
votes
1answer
25 views

Can sending the same plaintext twice, each encrypted with different key and IV, weaken the encryption?

I'm basing code on: https://wiki.openssl.org/index.php/EVP_Authenticated_Encryption_and_Decryption#Authenticated_Encryption_using_GCM_mode If I send the same plaintext twice, encrypting each with a ...
4
votes
2answers
168 views

Is it possible to recover AES-GCM plaintext when having everything but the additional data?

I'm using the window.crypto library in browsers. I use iv from window.crypto.getRandomValues...
3
votes
2answers
139 views

IV in Galois Counter Mode

I am looking at Wikepedia Galois Counter Mode article. I see this diagram I am trying to figure out where the IV works its way in. Is it used to initialize the counter? If so, how does a sequence of ...
3
votes
0answers
181 views

Why is counter mode encryption with a 16-byte cipher block not broken?

We determine a system IND-CPA secure when an adversary has a negligible advantage after any feasible amount of queries. AES256-GCM uses a 128bit block cipher. We know that the distinguishability ...
0
votes
1answer
491 views

Difference between AES-GCM encryption in dotnet and Node.js [closed]

I have a big problem about encryption with AES-GCM. Between using dotnet and Node.js, the encryption results are slightly different. Here is the code in Node.js from JOSE using Crypto Library : <...
1
vote
1answer
71 views

What does GHASH really do?

I try to understand the GCM-MODE used in TLS. The problem I have had is described below. 1:textbook describes how GHASH works: 2: I get some debuginfo from openssl code that contain enc_key(32 bytes)...
0
votes
0answers
204 views

Preventing replay attacks in a Web API that uses AES256

Background I am creating a Web API where both the request parameters and the response body are encrypted using AES-256-GCM. Vulnerability However, it is vulnerable to replay attacks. If someone ...
2
votes
1answer
381 views

AES 128 GCM - dynamic key with static IV/nonce

I'm working on a project to upgrade an existing system that currently uses RC4 to encrypt a payload with a random session key. The session key is then encrypted with asymmetric public key encryption (...
1
vote
2answers
204 views

Deciding on an AES cipher mode for chunked data

I'm trying to decide on which ciphermode to use for a programming excercise. I have a file that I need to encrypt without saving unencrypted data to storage and without storing the entire file in ...
2
votes
3answers
257 views

Why this complexity defining AES-GCM counter block?

AES-GCM counter block is defined as nonce || IV || counter. Why this complexity? Knowing that it does not need to be secret and its only required property is to be ...
3
votes
0answers
113 views

Add authenticated encryption additional data (AEAD) to data encryption key (DEK)?

When using a DEK to encrypt data using envelope encryption do you need to add AEAD to the DEK itself? I would think that it is unnecessary because bit flipping attacks are useless against a DEK and ...
1
vote
1answer
94 views

Is using ECDSA with AES-GCM viable?

I'm pretty new to the whole cryptography scene, so please forgive me if I make any incorrect statements. I have a 16MB image that I'm encrypting and authenticating using AES-GCM. I obtain a 16MB ...
6
votes
1answer
107 views

Is this a typo/error in the Galois/Counter mode specification or have I misunderstood?

I've been reading the following document describing Galois Counter Mode: The Galois/Counter Mode of Operation On page 7 of the document, the following diagram describes the ...
2
votes
1answer
71 views

GCM and decrypting with Krack

I'm trying to understand how Krack works on GCM. I thought that looking at GCM would be easier since it's a full break and the video shows a tool that is able to decrypt everything. I see that the IV ...
0
votes
1answer
1k views

Proper implementation of AES-256-GCM with PHP OpenSSL [closed]

I am really lost in this subject, I find it hard to get any reliable documentation on the subject that is a bit friendly for beginners like me. So I apologize in advance if this question would sound ...
1
vote
2answers
94 views

Why is the subhash key (H) of AES-GCM defined as such?

From what I've read in section 5.3 of NIST 800-38D it states: The hash subkey, denoted H, is generated by applying the block cipher to the “zero” block. In serious crypto J.P Aumasson describes ...
0
votes
1answer
217 views

Best practices: AES-GCM parameter (initialization-vector, …) transport

Apparently there is no mandatory method to transport AES-GCM parameters. I only read that the initialization vector often will be prefixed to the ciphertext. So, regarding the other parameters too, I ...
1
vote
1answer
87 views

AES-GCM: What can be done if 'H' is known by an attacker

What could an attacker do, if he had access to the value $H = AES(0)$ used for authentication in AES-GCM? Could the attacker do anything? Add some data in the authentication chain? Thanks
2
votes
2answers
311 views

AES-GCM for Securing Bluetooth Low Energy Application

I have a task at hand on designing security on Bluetooth Low Energy application layer. The system is created so that only smartphones with symmetric key (long term) could communicate and control my ...
6
votes
1answer
467 views

Deterministic Encryption with AES GCM - how to choose the IV (nonce)

I have not a very large background in cryptography so I hope these questions are not very dumb. I don't want to reinvent the wheel, I'm just looking for advise on the best practices about how to build ...
3
votes
1answer
663 views

Is AES-GCM with static key and dynamic salt safe to reuse IV/nonce

Problem: want to encrypt messages/objects/files using AES-GCM with the same secret key in a safe way, but want to do it in distributed/stateless way, so the IV of previous encryptions with the same ...
0
votes
1answer
425 views

AES-GCM Encryption and Replay Attacks

I have a doubt about AES-GCM on how can I avoid replay attacks. We have 2 users (Alice and Bob). After that the entities negotiate crypto parameters and generate a symmetric key, they'll exchange ...
2
votes
1answer
583 views

Apple secure notes. How secure?

In terms of cryptography, how secure is Apple Secure Notes? Can one store sensitive information there? The relevant section of the Apple white paper is quoted below: The Notes app includes a Secure ...
4
votes
2answers
586 views

Delayed tag checks in AES-GCM for streaming data

There is currently a GitHub discussion on .NET not supporting AES-GCM for any streaming data since releasing decrypted data prior to tag checks somehow reveals the plaintext or the AES key (or some ...