Questions tagged [aes-gcm]

Deprecated tag, see tag info. Advanced Encryption Standard Galois/Counter Mode, better known as AES-GCM is a mode of operation for symmetric key cryptographic block ciphers that has been widely adopted because of its efficiency and performance. GCM supports authenticated encryption, meaning that the mode not only offers privacy, but also integrity.

Filter by
Sorted by
Tagged with
1
vote
1answer
53 views

Decrypt authenticated cipher while still encrypting [duplicate]

Normal AES-GCM generates an authentication tag at the end of encryption. I want to decrypt it while it is still being encrypted. This would be useful to send, encrypt, receive and decrypt a large file ...
0
votes
0answers
5 views

Unable to decrypt aes-192-gcm [migrated]

I'm using nodejs to encrypt and decrypt aes-192-gcm here's my code: ...
0
votes
1answer
64 views

Do I still need SHA256 if I already had a AES 256 key that is 44 characters long?

Several months ago, I was required to research on AES and SHA-256 to make a secured license system for my app. However, I was dumb enough that couldn't distinguish between the 256 bits from AES and ...
1
vote
2answers
38 views

Plain text size limits for AES-GCM mode at 2GB with Sun JCE implementation?

The Sun JCE implementation of GCM is hard coded to refuse to encode more than 2 Gb, through the function GaloisCounterMode.checkDataLength() that returns an error message : "SunJCE provider only ...
0
votes
1answer
55 views

How does OPENSSL handle generation of unique IVs for AES-GCM

Generating unique IVs for AES GCM is elaborated in RFC-5288. However, I am unable to find an exact mapping of the explanation given in the RFC, with the OPENSSL C library. Could anyone help me with ...
1
vote
1answer
93 views

Encrypting more than ~64GiB with AES-GCM - Integrity

I'm looking for solution to encrypt more than acceptable limit ~64GiB under same key with AES-GCM. I know I'm obligated to exchange nonces for each next ~64GiB chunk, but there is one thing that is ...
0
votes
1answer
130 views

Apple CryptoKit - Understanding its portability

I've been playing with Apple's CryptoKit (their effort to make their old CommonCrypto lib more modern and easy to use via Swift, their programming language). I'm interested to see how portable it is.....
1
vote
2answers
113 views

How to implement correctly an Integrated Encryption Scheme?

I am developing a REST client (from an Android Point Of Sale) where I'm given a public RSA 2048-bit key and I need to encrypt transaction information. Since that single block cannot be encrypted (and ...
8
votes
3answers
1k views

Can a zero nonce be safely used with AES-GCM if the key is random and never used again?

I could generate a random nonce and prepend it to the ciphertext, but storage space is at a premium and the only constraint AES-GCM has on the nonce (if I'm reading correctly) is that the same nonce ...
2
votes
1answer
51 views

I need help determining the best encryption options based on System.Security.Cryptography in .NET

I asked a question here, and received a great summary but was redirected here. Covering the answers of the post, it was noted and suggested that: Use of plain (CBC) mode. They suggested to use GCM ...
1
vote
1answer
99 views

Why does Carter-Wegman (and AES-GCM) use different keys for PRF and keyed-hash

So. As I understand, Carter-Wegman transforms a one-time MAC (which must be a difference unpredictable function (DUF)) by encrypting it with a PRF. The DUF and the PRF use two different keys, which ...
0
votes
2answers
206 views

What Are the Risks of AES-GCM [Key, Nonce, Message] where Nonce = Message

A group of bankers will store sensitive financial information on a server owned by a third party. I represent the 3rd party server. The financial information will be stored as plain text on the ...
0
votes
1answer
45 views

GCM optimisation using $M_0$ and $R$ tables - Calculation of $R$

I'm implementing GCM in C as a way to learn about it. In the paper titled as The Galois/Counter Mode of Operation (GCM) by McGrew and Viega on chapter 4.1, page 11, 12, they talk about the ...
5
votes
0answers
269 views

Key size, performance, and security tradeoffs for AES-GCM, CCM

AES can be used with 128, 192 or 256 bit keys and each one appears to have a performance vs security trade-off (What is the effect of the different AES key lengths?, What are the practical differences ...
9
votes
1answer
254 views

how does BearSSL's GCM modular reduction work?

BearSSL (in src/hash/ghash_ctmul.c) seems to be doing a modular reduction that I don't completely understand. Here's the code: ...
7
votes
0answers
134 views

GCM with reversed poly

These slides talk about how GCM can be sped up if one uses $x^{128}+x^{127}+x^{126}+x^{121}+1$ as the reduction polynomial instead of $x^{128}+x^7+x^2+x^1+1$. When one is doing that one needs to ...
1
vote
2answers
229 views

how does AES GCM in SSH work?

I was looking at RFC5647: AES Galois Counter Mode for the Secure Shell Transport Layer Protocol and had some questions about section 7.1 "IV and Counter Management". Here's that section: ...
0
votes
1answer
229 views
0
votes
1answer
745 views

How to apply IV and tag to protect messages encrypted using AES-GCM?

I'm applying the Arduino Crypto Library for the code fragments. In the above library, example of encryption and decryption using GCM given as follows: For encryption: ...
1
vote
2answers
78 views

Using a hash of data instead of the full raw data for authenticated data in AES-GCM

I am serialising JSON objects, and would like to encrypt some of the values. I plan to do this with AES-GCM. I would also like to ensure the integrity of the overall object. The requirements are ...
2
votes
1answer
56 views

emulating AES GCM with AES CTR

Building off of Relationship between AES GCM and AES CTR... if your GCM nonce is "aaaa aaaa aaaa" (no spaces) then the CTR IV is that with (0,0,0,2) appending to it. My question is... what happens ...
1
vote
2answers
80 views

AES GCM mode and the message is the same as the password

In a case of using a password and get AES key using KDF to encrypt the same password (The password and the message is the same), How secure is that algorithm ?
1
vote
2answers
289 views

How is NIST's Key Wrap (using AES GCM) different than normal AES GCM Authenticated encryption?

From what I could gather, it seems like that NIST's key wrap (publication) provides similar security like AES-GCM Authenticated encryption. If this is true, why did we need a separate specification ...
2
votes
2answers
313 views

Is a single md5 hash a good way to generate an AES key?

This site says how to encrypt data using a password in go using AES-GCM. It says the following: When encrypting and decrypting data, it is important that you are using a 32 character, or 32 byte ...
1
vote
1answer
66 views

Does re-transmission really reduce security?

I am using AES with GCM and a colleague told me "Repeating a VCC with the same key and a different message reduces the security of the key." He did not have any additional detail to offer. What he ...
1
vote
1answer
117 views

lookup encrypted text by clear text without decryption

I've implemented vouchers module in my web project where I use it to generate redeem get etc... vouchers. since voucher codes are considered sensitive, I've considered to encrypt them using AES-GCM. ...
1
vote
1answer
220 views

AES-GCM secure against IND-CCA2

How would you prove that AES-GCM is secure against a chosen ciphertext attack (IND-CCA2), assuming that the attacker cannot forge AES-GCM MAC tags in less than brute force?
-1
votes
1answer
279 views

Differences between Webcrypto (js) and Cryptodome.Cipher.AES (python) [closed]

I'm trying to understand the difference in output of AES decrypt (GCM mode) using Webcrypto and Cryptodome.Cipher.AES in python. ...
4
votes
0answers
99 views

Patent Status & Usability of AE Modes [closed]

Post Structure: Sources Cited Question & Details Before You Answer Useful Info From Comments Sources Cited: https://blog.cryptographyengineering.com/2012/05/19/how-to-choose-authenticated-...
2
votes
0answers
249 views

WebCrypto AES-GCM vs AES-KW for key wrapping

The Web Crypto API available in most browsers supports both AES-GCM and AES-KW for key wrapping. There are examples for AES-KW and AES-GCM performing key wrapping, and a popular live table indicates ...
0
votes
2answers
352 views

Inverse MixColumns Operation of AES

I am aware that MixColumns is a mixing operation which operates on the columns of the state, combining the four bytes in each column. So we multiply our state with ...
1
vote
1answer
1k views

Encryption / Decryption using AES-256 GCM

I am new in cryptography and I am facing some complications in encryption-decryption. I am trying to use AES-GCM with a 256-bit AES key and a 96-bit nonce. I use an open source project (Vault) to ...
1
vote
1answer
228 views

Key generation for AES-GCM-256 file encryption

I am currently working on a file encryption software that works via AES-GCM-256 and I am looking for feedback on the encryption key generation process I intend to implement. So far, I have come up ...
2
votes
1answer
369 views

AES - which cipher is the safest one out there and what are the best practices for creating and storing the key

I just started to learn cryptography. I've read a ton of articles but couldn't find a book or a course that is based on this subject (and also is not outdated). Therefore I have a few questions (...
2
votes
1answer
105 views

Is using derived keys for HKDF + AES-GCM safe

I have an existing system which takes a cryptographically secure BLOB from user and pass it to lower API which calls HKDF-Expand to get 2 keys: one is effectively discarded in this scenario and second ...
2
votes
1answer
57 views

What would be an adversary advantage in case of GCM authentication?

Philip Rogaway has written a formula for CCM mode where the adversary advantage is given as: $$adversary\_advantage \leq \frac{q_{dec}}{2^t} + \frac{\sigma^2}{2^b}$$ Can we use this formula to find ...
0
votes
1answer
478 views

AES-GCM GHASH calculation;

I'm trying to make an GHASH() function and need some clarification. Implementation is based on gcm-spec. Page 8 describes polynomial mult and page 27 has a "Test Case 2" which I use to verify result. ...
3
votes
1answer
455 views

Real time video stream AES encryption with authentication

I am now studying AES encryption for real-time video streaming. It seems that Netflix uses the AES-GCM (or CBC + MAC) mode for real-time video encryption and authentication. With MAC authentication, ...
0
votes
2answers
635 views

AES-GCM conformance test

Is there any conformance tests/sequences to validate AES-GCM & GHASH() implementation? Details: I'm implementing AES-GSM, that's just for better understanding of that stuff, nothing more. Well I ...
2
votes
1answer
107 views

GCM mode of operation and IV size less 96 bits

GCM specification defines the initial counter value $Y_0$ for encryption/decryption operations as follows: $$ Y_0=\begin{cases} IV||0^{31}1 &\text{if len}(IV)=96\\ GHASH(H,\{\},IV)& \text{...
1
vote
2answers
376 views

Is it safe to use a counter as IV for AES256-GCM

What if I will use 96-bit integer counter starting from 0 as IV for AES256-GCM cipher. Is it safe? Is there any other ways to ensure uniqueness of IV for GCM cipher?
1
vote
2answers
73 views

Is the key safe if attacker know the encrypted and decrypted message?

Given an attacker know both the encrypted message (+ an iv) and the equivalent decrypted message, is it possible for him to craft a new encrypted message that could result in a desired decrypted ...
2
votes
1answer
138 views

Why is GCM not vulnerable at the birthday bound for 128 bit IV?

According to this article, which looks at attacks on Caesar candidates beyond what they claim, they include an attack on page 6 for nonce-respecting adversaries for AES-GCM which allows IVs longer ...
1
vote
1answer
111 views

It's safe to store a known value (for checking) next to the actually encrypted values

The high level details of the encryption I'm using is: AndroidKeyStore create/store RSA key AES key is created and wrapped with RSA/ECB/PKCS1Padding Encrypted AES is saved to disk. Data is encrypted ...
0
votes
1answer
199 views

Good practices for AES key derivation and management

I'm developping a device based on STM32L4x6. It is connected through BLE to a smartphone and it exchanges encrypted data with it. Data consists of health data of patients. Encryption is AES-GCM 256 ...
0
votes
2answers
467 views

Which is slower, AES or GCM hash (GHASH), if CPU has no special instructions?

In an answer to this question: Security of GCM if Implemented with Stream Cipher instead of Block Cipher ...it was stated that: The GHASH part of GCM is usually the problematic one when it comes to ...
7
votes
1answer
2k views

TLS 1.2 Cipher Suites With AES-GCM – What data (if any) is passed to the AES-GCM cipher as the Additional Authentication Data?

TLS 1.2 defines a number of cipher suites that employ AES-GCM, e.g.: ...
2
votes
2answers
371 views

Key wrapping - encrypting many times with AES-GCM

When encrypting many short plaintexts with a single key, lets say about 2^64 total plaintexts at under 64 bytes each: (edit note - was 2^70 in the original question) Is there a way to use AES-GCM, as ...
1
vote
1answer
61 views

Will AES-GCM smaller sized tag (mac) be included in larger sized tag

I want to make sure that I understand AES-GCM correctly: If I have: key1, plaintext1, iv1, adata1 and requset tag size of 96 bits, and tag size of 128 bits, will the first 12 bytes of the 128 bits ...
0
votes
2answers
1k views

Appropriate key for AES 256 GCM

I am updating a system that has Rails' OpenSSL on one side and Python's cryptography.io on the other. The Rails side has to generate keys for the AES-256-GCM and here are two methods that appear to ...