Questions tagged [aes-gcm]

Deprecated tag, see tag info. Advanced Encryption Standard Galois/Counter Mode, better known as AES-GCM is a mode of operation for symmetric key cryptographic block ciphers that has been widely adopted because of its efficiency and performance. GCM supports authenticated encryption, meaning that the mode not only offers privacy, but also integrity.

Filter by
Sorted by
Tagged with
2 votes
1 answer
223 views

Is it possible to reverse GHASH from GCM?

How can I create a "reverse" GHASH algorithm for GCM that allows me to compute an input value that generates a specific chosen output, given that I know the authentication key H? If this is ...
  • 29
3 votes
1 answer
49 views

GCM-SIV vs CBC with fixed IV?

I keep hearing CBC with fixed IV mode is bad because it has similar issues to the codebook breakdown of ECB mode. However, people seem quite willing to recommend AES-GCM-SIV for deterministic ...
  • 31
0 votes
1 answer
37 views

Implementing AES GCM but not getting correct output from cipher block

I'm implementing 128-bit AES-GCM (but only the encryption/AES-CTR aspect). When I set the Secret Key, Plaintext and IV to Test Case 2, page 27 of the GCM spec (see below) I get the wrong value for the ...
0 votes
1 answer
32 views

AES GCM Difference between the IV and the Secret Key?

Below is part of AES GCM diagram. However, it only shows the behavior of the IV/counter. The GCM specification examples state both an IV and a Secret Key as two inputs. Can someone please explain ...
1 vote
1 answer
56 views

Drawbacks of multiple sources of entropy for AES

Since AES needs IV to be random (unless fed by a unit test), I was wondering how to properly handle it. I know that Intel/AMD now supports the rdrand64 function but ...
  • 23
1 vote
1 answer
48 views

AES256-GCM padding for unaligned blocks

So I found some test vectors for my SSE implementation of AES256-GCM and unfortunately it seems that after the last step of AAD it goes wrong. My guess is that this is because the AAD is actually ...
  • 23
4 votes
2 answers
746 views

OpenSSL AES-GCM says 'bad decrypt', other block modes work fine?

If I do a simple encrypt and decrypt test like so: ...
  • 1,387
2 votes
1 answer
185 views

AES-GCM with HMAC

I am using AES-GCM to encrypt some data. I want every encryption to be done with a new random iv. For every encryption a new iv is generated and appended to the encrypted text to produce the cipher. ...
  • 21
2 votes
1 answer
204 views

Understanding AES-GCM IV (Nonce), Tag/MAC, Message & Transmission

I am working on a project that uses PAKE (SRP) for authentication. When we send the M1 to the server we are encrypting the payload using AES-GCM. I mention SRP only to set the context: A message is ...
  • 123
1 vote
1 answer
156 views

What does AES-GCM provide?

I am wondering does AES-GCM which uses Authenticated Encryption provide us with all 3 properties (Authenticity, Confidentiality, and Integrity), or does it not provide integrity?
1 vote
1 answer
826 views

How long does it take to decrypt AES encrypted message with salt(for pbkdf2 key) and iv known

I'm new to crypto! The situation is, Aes-256-cbc encrypted message(including not encrypted iv & salt) is revealed. We also know pbkdf2 function uses 10000 rounds with sha256. All we need to ...
  • 11
1 vote
0 answers
55 views

Should I encrypt individual columns or all data?

I want to AES-GCM some user data that I‘m going to persist in a database. I‘m wondering if I should encrypt individual columns (all with an individual IV ofc) or JSON stringify the sensitive data and ...
  • 111
0 votes
0 answers
76 views

How can I show that AES-GCM is secure under the adaptive chosen cipher-text game?

How can I show that AES-GCM is secure under the adaptive chosen ciphertext game? This is assuming the GHASH Mac tag can't be forged faster than brute force?
0 votes
0 answers
256 views

Decryption failure for NIST vector AES-CBC-128

I am learning/exploring the openssl library for encrypting and decrypting data while encryption goes through fine I see standalone decryption not working as I expected. The test vector I am using is <...
  • 1
1 vote
1 answer
297 views

How are long IVs used in AES-GCM?

I looked through NIST's official test vectors (CAVP) for the AES-GCM mode, and noticed that there are some test vectors in there with 8-bit or 1024-bit IVs. But as far as I understand, the GCM ...
  • 201
0 votes
1 answer
156 views

What is the use of Additional data or associated data in AESGcm. How it is used while encryption and decryption [closed]

I am trying to understand the AESGcm encryption and decryption and there's one field associated data in Encryption and Decryption methods. https://learn.microsoft.com/en-us/dotnet/api/system.security....
1 vote
0 answers
72 views

Using a signature as key material

I am designing my first web3 app and I would like to use MetaMask as an identity and crypto provider. My web3 app will encrypt user data with AES-GCM, but I do not want to generate and store an ...
  • 11
0 votes
1 answer
77 views

Is MAC unnecessary for client side encryption?

In my open source with offline client side encryption application, I plan to use AES-CTR or ChaCha20 without MAC instead of GCM or Poly1305 since: There is no database, the ciphertext, nonce, tag ...
  • 155
0 votes
2 answers
401 views

How is AES256-GCM auth tag used in decryption

I have been playing with AES256-GCM in NodeJS crypto library and it shows that the original message can be decrypted without caring about the auth tag. So can a non-tag verified decryption be secure? ...
  • 155
0 votes
1 answer
510 views

How is AES-GCM IV and auth tag used?

I have been learning about AES-GCM and AES in general lately and founding: The key is the secret and both sender and receiver keep it hidden forever. The IV and auth tag are public and sent along with ...
  • 155
1 vote
1 answer
405 views

Aes-Gcm how to perform decryption authentication without plaintext output in C#

I'm mainly trying to verify large file chunks which are encrypted each alone with a different key/salt/nonce for each chunk then appended to the whole file in the end to form 1 file. One thing I ...
  • 23
1 vote
1 answer
1k views

How does AES GCM encryption work

Previously, I used AES CBC 256 with 256 bit key and 128 bit IV. However it seems slow so I decide to switch to AES GCM 256 bit key, 96 bit IV which has some parts I don't understand such as: Auth tag:...
  • 155
1 vote
2 answers
196 views

Argon2id creating key for cryptography, how acceptable is it to use the same salt for the same encryption operation?

Everyone knows Argon2id is a slow hashing algorithm, and that's on purpose, all is good. When creating an Argon2id object a lot of parameters are needed to be taken into consideration ultimately ...
  • 23
1 vote
2 answers
427 views

Does the AES-GCM specification require the tag-size to be bound to the GCM context?

Does GCM spec (NIST SP 800-38D) require tag-size to be fixed for an instance of GCM algorithm (which usually fixes a specific GCM key)? Asked differently, is the following a legitimate adherence to ...
0 votes
0 answers
60 views

Encrypt user AES keys with AWS KMS RSA key

I am developing a web application in which each user has some part of his data that is stored encrypted. We are hosted on AWS and I want to use KMS as part of the solution. To not make the solution ...
3 votes
1 answer
114 views

AES-GCM with different IVs but close enough for counter to cause duplicates

I am planning to use AES-GCM or AES-CTR for encryption. However, I have read from several sources that the IVs must be unique for every piece of information encrypted. I have a doubt though, what if I ...
1 vote
1 answer
567 views

Using AES-256-GCM, is your security only 128 bits when solely relying on the MAC?

Since the maximum authentication tag (MAC) size of AES-256-GCM is 16 bytes, And given that in one implementation, that breaking the MAC would break the security (ex. when a boolean 'decrypted' is used ...
1 vote
1 answer
60 views

How does a GMAC in GCM not nullify the utility of a seekable decrypt-able stream

I have been looking at the Galois/Counter Mode (GCM) for stream encryption. I understand the idea that it's a stream cipher and so it can be encrypted one bit at a time by XORing with the key stream ...
  • 113
3 votes
1 answer
177 views

Key Committing AES-GCM

There is a handful of attacks against AEAD, and GCM in particular, which demonstrates that it is feasible for an attacker $\mathcal{A}$ to obtain a ciphertext $C$ which encrypts to multiple key/...
2 votes
2 answers
579 views

For AES-GCM, does knowing plaintext and ciphertext allow attacker to learn the key?

Say, for an AES-GCM encryption, an attacker knows essentially everything except the key. This would include: Plaintext Ciphertext IV Algorithm (AES-GCM) In this case, will the attacker gain any ...
0 votes
1 answer
84 views

AES GCM mode - what is ouput in that scheme?

I'm trying to understand that scheme: https://xilinx.github.io/Vitis_Libraries/security/2019.2/guide_L1/internals/gcm.html Here on page 11 it looks like GHASH gives only one value "Return $Y_m$&...
  • 1,171
2 votes
1 answer
1k views

Validating AES GCM authentication tag between two different implementations

I'm a bit confused on how to validate the authentication tag between two different AES GCM implementations. One implementation (on my part) is in Java. The other, I don't know. In my implementation, ...
1 vote
0 answers
315 views

How fast is GHASH and what does it do?

I read here: https://www.researchgate.net/publication/220335697_GCM_GHASH_and_Weak_Keys how GHASH works. So we have $m$ 128-bit blocks $X_{i}$ and we compute in $GF(2^{128})$: $Y_{m} = \sum_{i=1}^{m} ...
  • 1,171
1 vote
1 answer
1k views

Is AES GCM with PBKDF2 100k iterations still ok as of 2022?

Is using AES GCM with PBKDF2 and 100 000 iterations still considered secure as of 2022? In our threat model, if we ignore the risks linked to quantum computing, is this secure? Here is an example ...
  • 533
1 vote
1 answer
132 views

Clarification on nonce collision calculation

I've been working on a AES256-GCM implementation (in Java). I'm a little bit stuck on the part where i need to decide how often i need to rotate my key. I've got a lot of information from this posts: ...
1 vote
1 answer
146 views

some questions about IPSEC ESN

ESN feature is described in RFC 4303. Here is some questions which bothered me: When use ESN combined with AES_GCM or AES_GMAC alogrithom, do I need to add the high-order ESN bits to the packets? ...
  • 11
1 vote
1 answer
155 views

Multiple Encryption Using GCM For Multi-Key Security

Multiple Encryption For Multi-Key Security I have a hypothetical question about multiple encryption after reading Matthew Green’s blog on multiple encryption. For those who are familiar with GCM…I ...
  • 11
1 vote
1 answer
391 views

Is AES GCM without GMAC vulnerable against known plaintext attack?

Is AES GCM without GMAC vulnerable against bit-flip attacks? Let's assume the plaintext is known for some reason (e.g. it can be guessed). In my opinion, I can flip bits in the ciphered blocks and can ...
  • 1,477
1 vote
0 answers
613 views

AES256-GCM Is it safe to both add the IV to the AAD and use it in the encryption?

I'm looking at a protocol which adds the IV (used for the encryption) into the AAD. If the IV (which is part of the message) was incorrect, decryption would fail anyway. Why is it useful to add the IV ...
  • 771
1 vote
1 answer
721 views

Is it possible to partially decrypt an aes-gcm ciphertext?

Say that I encrypt a large file using aes-gcm and upload it somewhere. Can I then download only the first few blocks (as well as IV and tag) and decrypt them? If not, is there another authenticated ...
  • 431
4 votes
1 answer
317 views

Is GCM with zero-length AAD less secure?

In a previous question, it was made clear that in the case of GCM, there is no distinction between "no AAD" and "zero-length AAD". Since I have noticed "zero-length AAD" ...
  • 171
-1 votes
1 answer
106 views

What would be the benefits of using a faster cryptographic system with the same level of security as AES

Essentially I'm asking, what if I have designed a quantum-proof stream cipher that is faster than AES-256? Will using less computational power for encryption/decryption be valuable to companies or ...
1 vote
0 answers
35 views

How safe is store nonce with encrypted text? [duplicate]

I am using AESGCM256 with a nonce of 96 bytes to store keys (very secret information). There are more than 500 keys, the only place where they can be stored in ...
0 votes
1 answer
757 views

AES-GCM encryption in .NET Core

I created a crypto service using AES-GCM in order to encrypt the sensitive data in database. Firstly, I'm generating a cryptographic key from a password (probably will be stored in Kubernetes Secrets) ...
0 votes
1 answer
111 views

Security level of Poly1305 and GMAC

The Libsodium docs list the AEAD forgery limits for ChaCha20Poly1305 and AES-GCM which seems like a < 128-bit security level but says that it's not a practical concern. I've seen other people say ...
1 vote
1 answer
573 views

API key generation technique

I am designing an web api which needs to grant access to various client apps via an api key sent as http header. I know, not really how it should be done but I have no control over this part. My ...
  • 11
2 votes
2 answers
446 views

FOR AES GCM decrypt function, Does the output(PT) depend on Tag value(T)?

According to spec, FOR GCM decrypt function input is IV, A, C, and T. As mentioned below: 5.2.2 Authenticated Decryption Function Given the selection of an approved block cipher, key, and an ...
2 votes
1 answer
229 views

What benefit is gained when combining AES GCM/GMAC with ECDSA?

This is a real world question (and as I'm not an expert in cryptography I have only some basic knowledge in terms of just using it, not a deep understanding how ist works under the hood.): A system ...
  • 1,477
0 votes
1 answer
119 views

What is the term to describe the combination of ciphertext, IV and authentication tag?

Authenticated encryption with associated data, such as AES-GCM, will take as input: IV, optional associated data, plaintext and key. A ciphertext and an authentication tag will be produced. Is there a ...
  • 4,257
2 votes
1 answer
242 views

Can the AES-GCM authentication tag be used as a key derivation function?

I want to build a deterministic key derivation tree, where the root is stored securely in a centralized service and the leaves are embedded in a multitude of devices. When a device wants to ...
  • 532