Questions tagged [aes-gcm]

Deprecated tag, see tag info. Advanced Encryption Standard Galois/Counter Mode, better known as AES-GCM is a mode of operation for symmetric key cryptographic block ciphers that has been widely adopted because of its efficiency and performance. GCM supports authenticated encryption, meaning that the mode not only offers privacy, but also integrity.

Filter by
Sorted by
Tagged with
0 votes
0 answers
120 views

Decryption failure for NIST vector AES-CBC-128

I am learning/exploring the openssl library for encrypting and decrypting data while encryption goes through fine I see standalone decryption not working as I expected. The test vector I am using is <...
  • 1
1 vote
1 answer
119 views

How are long IVs used in AES-GCM?

I looked through NIST's official test vectors (CAVP) for the AES-GCM mode, and noticed that there are some test vectors in there with 8-bit or 1024-bit IVs. But as far as I understand, the GCM ...
  • 161
0 votes
1 answer
32 views

What is the use of Additional data or associated data in AESGcm. How it is used while encryption and decryption [closed]

I am trying to understand the AESGcm encryption and decryption and there's one field associated data in Encryption and Decryption methods. https://learn.microsoft.com/en-us/dotnet/api/system.security....
1 vote
0 answers
58 views

Using a signature as key material

I am designing my first web3 app and I would like to use MetaMask as an identity and crypto provider. My web3 app will encrypt user data with AES-GCM, but I do not want to generate and store an ...
  • 11
0 votes
1 answer
61 views

Is MAC unnecessary for client side encryption?

In my open source with offline client side encryption application, I plan to use AES-CTR or ChaCha20 without MAC instead of GCM or Poly1305 since: There is no database, the ciphertext, nonce, tag ...
0 votes
2 answers
98 views

How is AES256-GCM auth tag used in decryption

I have been playing with AES256-GCM in NodeJS crypto library and it shows that the original message can be decrypted without caring about the auth tag. So can a non-tag verified decryption be secure? ...
0 votes
1 answer
63 views

How is AES-GCM IV and auth tag used?

I have been learning about AES-GCM and AES in general lately and founding: The key is the secret and both sender and receiver keep it hidden forever. The IV and auth tag are public and sent along with ...
1 vote
1 answer
108 views

Aes-Gcm how to perform decryption authentication without plaintext output in C#

I'm mainly trying to verify large file chunks which are encrypted each alone with a different key/salt/nonce for each chunk then appended to the whole file in the end to form 1 file. One thing I ...
  • 23
1 vote
1 answer
197 views

How does AES GCM encryption work

Previously, I used AES CBC 256 with 256 bit key and 128 bit IV. However it seems slow so I decide to switch to AES GCM 256 bit key, 96 bit IV which has some parts I don't understand such as: Auth tag:...
1 vote
2 answers
74 views

Argon2id creating key for cryptography, how acceptable is it to use the same salt for the same encryption operation?

Everyone knows Argon2id is a slow hashing algorithm, and that's on purpose, all is good. When creating an Argon2id object a lot of parameters are needed to be taken into consideration ultimately ...
  • 23
1 vote
2 answers
234 views

Does the AES-GCM specification require the tag-size to be bound to the GCM context?

Does GCM spec (NIST SP 800-38D) require tag-size to be fixed for an instance of GCM algorithm (which usually fixes a specific GCM key)? Asked differently, is the following a legitimate adherence to ...
0 votes
0 answers
39 views

Encrypt user AES keys with AWS KMS RSA key

I am developing a web application in which each user has some part of his data that is stored encrypted. We are hosted on AWS and I want to use KMS as part of the solution. To not make the solution ...
3 votes
1 answer
86 views

AES-GCM with different IVs but close enough for counter to cause duplicates

I am planning to use AES-GCM or AES-CTR for encryption. However, I have read from several sources that the IVs must be unique for every piece of information encrypted. I have a doubt though, what if I ...
1 vote
1 answer
474 views

Using AES-256-GCM, is your security only 128 bits when solely relying on the MAC?

Since the maximum authentication tag (MAC) size of AES-256-GCM is 16 bytes, And given that in one implementation, that breaking the MAC would break the security (ex. when a boolean 'decrypted' is used ...
1 vote
1 answer
44 views

How does a GMAC in GCM not nullify the utility of a seekable decrypt-able stream

I have been looking at the Galois/Counter Mode (GCM) for stream encryption. I understand the idea that it's a stream cipher and so it can be encrypted one bit at a time by XORing with the key stream ...
  • 113
3 votes
1 answer
126 views

Key Committing AES-GCM

There is a handful of attacks against AEAD, and GCM in particular, which demonstrates that it is feasible for an attacker $\mathcal{A}$ to obtain a ciphertext $C$ which encrypts to multiple key/...
1 vote
2 answers
339 views

For AES-GCM, does knowing plaintext and ciphertext allow attacker to learn the key?

Say, for an AES-GCM encryption, an attacker knows essentially everything except the key. This would include: Plaintext Ciphertext IV Algorithm (AES-GCM) In this case, will the attacker gain any ...
0 votes
1 answer
52 views

AES GCM mode - what is ouput in that scheme?

I'm trying to understand that scheme: https://xilinx.github.io/Vitis_Libraries/security/2019.2/guide_L1/internals/gcm.html Here on page 11 it looks like GHASH gives only one value "Return $Y_m$&...
  • 1,043
2 votes
1 answer
276 views

Validating AES GCM authentication tag between two different implementations

I'm a bit confused on how to validate the authentication tag between two different AES GCM implementations. One implementation (on my part) is in Java. The other, I don't know. In my implementation, ...
1 vote
0 answers
115 views

How fast is GHASH and what does it do?

I read here: https://www.researchgate.net/publication/220335697_GCM_GHASH_and_Weak_Keys how GHASH works. So we have $m$ 128-bit blocks $X_{i}$ and we compute in $GF(2^{128})$: $Y_{m} = \sum_{i=1}^{m} ...
  • 1,043
1 vote
1 answer
258 views

Is AES GCM with PBKDF2 100k iterations still ok as of 2022?

Is using AES GCM with PBKDF2 and 100 000 iterations still considered secure as of 2022? In our threat model, if we ignore the risks linked to quantum computing, is this secure? Here is an example ...
  • 501
1 vote
1 answer
73 views

Clarification on nonce collision calculation

I've been working on a AES256-GCM implementation (in Java). I'm a little bit stuck on the part where i need to decide how often i need to rotate my key. I've got a lot of information from this posts: ...
1 vote
1 answer
77 views

some questions about IPSEC ESN

ESN feature is described in RFC 4303. Here is some questions which bothered me: When use ESN combined with AES_GCM or AES_GMAC alogrithom, do I need to add the high-order ESN bits to the packets? ...
  • 11
1 vote
1 answer
106 views

Multiple Encryption Using GCM For Multi-Key Security

Multiple Encryption For Multi-Key Security I have a hypothetical question about multiple encryption after reading Matthew Green’s blog on multiple encryption. For those who are familiar with GCM…I ...
  • 11
1 vote
1 answer
188 views

Is AES GCM without GMAC vulnerable against known plaintext attack?

Is AES GCM without GMAC vulnerable against bit-flip attacks? Let's assume the plaintext is known for some reason (e.g. it can be guessed). In my opinion, I can flip bits in the ciphered blocks and can ...
  • 1,447
1 vote
0 answers
384 views

AES256-GCM Is it safe to both add the IV to the AAD and use it in the encryption?

I'm looking at a protocol which adds the IV (used for the encryption) into the AAD. If the IV (which is part of the message) was incorrect, decryption would fail anyway. Why is it useful to add the IV ...
  • 731
1 vote
1 answer
367 views

Is it possible to partially decrypt an aes-gcm ciphertext?

Say that I encrypt a large file using aes-gcm and upload it somewhere. Can I then download only the first few blocks (as well as IV and tag) and decrypt them? If not, is there another authenticated ...
  • 411
4 votes
1 answer
205 views

Is GCM with zero-length AAD less secure?

In a previous question, it was made clear that in the case of GCM, there is no distinction between "no AAD" and "zero-length AAD". Since I have noticed "zero-length AAD" ...
  • 161
-1 votes
1 answer
104 views

What would be the benefits of using a faster cryptographic system with the same level of security as AES

Essentially I'm asking, what if I have designed a quantum-proof stream cipher that is faster than AES-256? Will using less computational power for encryption/decryption be valuable to companies or ...
1 vote
0 answers
33 views

How safe is store nonce with encrypted text? [duplicate]

I am using AESGCM256 with a nonce of 96 bytes to store keys (very secret information). There are more than 500 keys, the only place where they can be stored in ...
0 votes
1 answer
447 views

AES-GCM encryption in .NET Core

I created a crypto service using AES-GCM in order to encrypt the sensitive data in database. Firstly, I'm generating a cryptographic key from a password (probably will be stored in Kubernetes Secrets) ...
0 votes
1 answer
92 views

Security level of Poly1305 and GMAC

The Libsodium docs list the AEAD forgery limits for ChaCha20Poly1305 and AES-GCM which seems like a < 128-bit security level but says that it's not a practical concern. I've seen other people say ...
1 vote
1 answer
339 views

API key generation technique

I am designing an web api which needs to grant access to various client apps via an api key sent as http header. I know, not really how it should be done but I have no control over this part. My ...
  • 11
2 votes
2 answers
353 views

FOR AES GCM decrypt function, Does the output(PT) depend on Tag value(T)?

According to spec, FOR GCM decrypt function input is IV, A, C, and T. As mentioned below: 5.2.2 Authenticated Decryption Function Given the selection of an approved block cipher, key, and an ...
2 votes
1 answer
137 views

What benefit is gained when combining AES GCM/GMAC with ECDSA?

This is a real world question (and as I'm not an expert in cryptography I have only some basic knowledge in terms of just using it, not a deep understanding how ist works under the hood.): A system ...
  • 1,447
0 votes
1 answer
82 views

What is the term to describe the combination of ciphertext, IV and authentication tag?

Authenticated encryption with associated data, such as AES-GCM, will take as input: IV, optional associated data, plaintext and key. A ciphertext and an authentication tag will be produced. Is there a ...
  • 3,902
2 votes
1 answer
172 views

Can the AES-GCM authentication tag be used as a key derivation function?

I want to build a deterministic key derivation tree, where the root is stored securely in a centralized service and the leaves are embedded in a multitude of devices. When a device wants to ...
  • 472
3 votes
1 answer
109 views

Factorization of polynomial in GF(2^128) used in GCM

It is widely known, that using a GCM nonce twice or even more often can be used to disclose the authentication key H. I understand, why this is theoretically possible. However, I have no feeling about ...
  • 1,447
1 vote
1 answer
245 views

Why using same nonce (IV) twice voids confidentiality of plain text or even key?

I understand roughly (without details of GF algebra) the scheme of GCS/GMAC: IV is to be put into Counter-0, so initializing counters. It is known, that using a IV twice can not only reveal the plain ...
  • 1,447
0 votes
0 answers
90 views

Proper implementation AES-256 for single block E_k then being used on AES-GCM

My first objective is to implement AES-GCM in PowerShell 5.1 since there is not an implementation that not use external dll libraries. According to the GCM schema of encryption: the E_k block should ...
1 vote
0 answers
36 views

Does my asymmetric/symmetric mixed file encryption pseudo code pass sanity check?

I realize this depends on my implementation and the implementation of the libraries I use. I am asking about my process assuming that the encryption libraries and my code are not flawed/compromised, ...
  • 123
-1 votes
2 answers
3k views

Special characters in AES Encryption Key

We all know that AES uses Key, IV and salt. But what if we add special ASCII characters like Alternate 255 (" ") or Alternatively 163 ("£") or Alternate 224 ("α") in the ...
  • 3
1 vote
0 answers
170 views

Constructing an XChaCha20-Poly1305 Equivalent using FIPS-140 Primitives

I am playing around with the idea of modelling clustered data storage as a series of AEAD messages. XChaCha20-Poly1305 has nice properties for my intended design, as the ability to use random IVs ...
  • 111
0 votes
2 answers
369 views

what is auth data in AES-GCM

I am trying to understand AES-GCM and I do not understand what I should transmit to Auth Data during encryption. What kind of data is that?
3 votes
1 answer
98 views

Using keys as Additional Authentication Data in GCM

In my opinion, it's not a good idea to use (symmetric/asymmetric) keys as Additional Authentication Data (AAD) in GCM as AAD is only authenticated but not encrypted. The key will be protected from ...
  • 31
1 vote
1 answer
108 views

Cipher Text generated is different if nonce is greater than 12 bytes

I wrote a library which uses AES-GCM-128 to perform encrypt and decrypt operations. This library uses EVP functions that provide a high level interface to OpenSSL cryptographic functions. To verify my ...
1 vote
3 answers
570 views

What's the preferable encryption for large data and files in terms of speed and security other than AES?

First of all, I'm relatively new to encryption so please bear with me. I'm looking for a way to encrypt large amounts of data only on my device, no need to transfer my encrypted files/data (10-20GB or ...
1 vote
0 answers
65 views

Usage of block and stream ciphers

I see that in many applications stream ciphers are common than block cipher - whether is Salsa20, AES-GCM, etc. In which cases would a stream cipher be preferred over a block cipher and vice versa? ...
  • 21
1 vote
2 answers
468 views

Stream cipher and block cipher usage in network data encryption

Stream ciphers are usually used for streaming data encryption, such as voice, and also for low layers data encryption. For example, MACSec uses AES-GCM encryption. In L3 ad L4 security protocols (...
  • 21
4 votes
1 answer
227 views

Is a stream cipher and a (cryptographically secure) PRNG nearly the same thing?

If I let the authentification tag aside (which is important), encrypting with AES-GCM and a fixed key and nonce: ...
  • 501