Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [aes-gcm]

Advanced Encryption Standard Galois/Counter Mode, better known as AES-GCM is a mode of operation for symmetric key cryptographic block ciphers that has been widely adopted because of its efficiency and performance. GCM supports authenticated encryption, meaning that the mode not only offers privacy, but also integrity.

9
votes
1answer
181 views

how does BearSSL's GCM modular reduction work?

BearSSL (in src/hash/ghash_ctmul.c) seems to be doing a modular reduction that I don't completely understand. Here's the code: ...
6
votes
0answers
88 views

GCM with reversed poly

These slides talk about how GCM can be sped up if one uses $x^{128}+x^{127}+x^{126}+x^{121}+1$ as the reduction polynomial instead of $x^{128}+x^7+x^2+x^1+1$. When one is doing that one needs to ...
1
vote
2answers
78 views

how does AES GCM in SSH work?

I was looking at RFC5647: AES Galois Counter Mode for the Secure Shell Transport Layer Protocol and had some questions about section 7.1 "IV and Counter Management". Here's that section: ...
0
votes
1answer
67 views

How to apply IV and tag to protect messages encrypted using AES-GCM?

I'm applying the Arduino Crypto Library for the code fragments. In the above library, example of encryption and decryption using GCM given as follows: For encryption: ...
1
vote
2answers
64 views

Using a hash of data instead of the full raw data for authenticated data in AES-GCM

I am serialising JSON objects, and would like to encrypt some of the values. I plan to do this with AES-GCM. I would also like to ensure the integrity of the overall object. The requirements are ...
2
votes
1answer
45 views

emulating AES GCM with AES CTR

Building off of Relationship between AES GCM and AES CTR... if your GCM nonce is "aaaa aaaa aaaa" (no spaces) then the CTR IV is that with (0,0,0,2) appending to it. My question is... what happens ...
1
vote
2answers
48 views

AES GCM mode and the message is the same as the password

In a case of using a password and get AES key using KDF to encrypt the same password (The password and the message is the same), How secure is that algorithm ?
1
vote
1answer
90 views

How is NIST's Key Wrap (using AES GCM) different than normal AES GCM Authenticated encryption?

From what I could gather, it seems like that NIST's key wrap (publication) provides similar security like AES-GCM Authenticated encryption. If this is true, why did we need a separate specification ...
2
votes
2answers
103 views

Is a single md5 hash a good way to generate an AES key?

This site says how to encrypt data using a password in go using AES-GCM. It says the following: When encrypting and decrypting data, it is important that you are using a 32 character, or 32 byte ...
1
vote
1answer
55 views

Does re-transmission really reduce security?

I am using AES with GCM and a colleague told me "Repeating a VCC with the same key and a different message reduces the security of the key." He did not have any additional detail to offer. What he ...
1
vote
1answer
48 views

lookup encrypted text by clear text without decryption

I've implemented vouchers module in my web project where I use it to generate redeem get etc... vouchers. since voucher codes are considered sensitive, I've considered to encrypt them using AES-GCM. ...
1
vote
1answer
138 views

AES-GCM secure against IND-CCA2

How would you prove that AES-GCM is secure against a chosen ciphertext attack (IND-CCA2), assuming that the attacker cannot forge AES-GCM MAC tags in less than brute force?
-1
votes
1answer
183 views

Differences between Webcrypto (js) and Cryptodome.Cipher.AES (python) [closed]

I'm trying to understand the difference in output of AES decrypt (GCM mode) using Webcrypto and Cryptodome.Cipher.AES in python. ...
4
votes
0answers
66 views

Patent Status & Usability of AE Modes [closed]

Post Structure: Sources Cited Question & Details Before You Answer Useful Info From Comments Sources Cited: https://blog.cryptographyengineering.com/2012/05/19/how-to-choose-authenticated-...
2
votes
0answers
79 views

WebCrypto AES-GCM vs AES-KW for key wrapping

The Web Crypto API available in most browsers supports both AES-GCM and AES-KW for key wrapping. There are examples for AES-KW and AES-GCM performing key wrapping, and a popular live table indicates ...
0
votes
2answers
150 views

Inverse MixColumns Operation of AES

I am aware that MixColumns is a mixing operation which operates on the columns of the state, combining the four bytes in each column. So we multiply our state with ...
1
vote
1answer
498 views

Encryption / Decryption using AES-256 GCM

I am new in cryptography and I am facing some complications in encryption-decryption. I am trying to use AES-GCM with a 256-bit AES key and a 96-bit nonce. I use an open source project (Vault) to ...
1
vote
1answer
124 views

Key generation for AES-GCM-256 file encryption

I am currently working on a file encryption software that works via AES-GCM-256 and I am looking for feedback on the encryption key generation process I intend to implement. So far, I have come up ...
2
votes
1answer
188 views

AES - which cipher is the safest one out there and what are the best practices for creating and storing the key

I just started to learn cryptography. I've read a ton of articles but couldn't find a book or a course that is based on this subject (and also is not outdated). Therefore I have a few questions (...
2
votes
1answer
56 views

Is using derived keys for HKDF + AES-GCM safe

I have an existing system which takes a cryptographically secure BLOB from user and pass it to lower API which calls HKDF-Expand to get 2 keys: one is effectively discarded in this scenario and second ...
2
votes
1answer
32 views

What would be an adversary advantage in case of GCM authentication?

Philip Rogaway has written a formula for CCM mode where the adversary advantage is given as: $$adversary\_advantage \leq \frac{q_{dec}}{2^t} + \frac{\sigma^2}{2^b}$$ Can we use this formula to find ...
0
votes
1answer
216 views

AES-GCM GHASH calculation;

I'm trying to make an GHASH() function and need some clarification. Implementation is based on gcm-spec. Page 8 describes polynomial mult and page 27 has a "Test Case 2" which I use to verify result. ...
2
votes
1answer
165 views

Real time video stream AES encryption with authentication

I am now studying the AES encryption for real-time video stream. It seems that Netflix uses the AES-GCM (or CBC + MAC) mode for real-time video encryption and authentication. With MAC authentication, ...
0
votes
2answers
231 views

AES-GCM conformance test

Is there any conformance tests/sequences to validate AES-GCM & GHASH() implementation? Details: I'm implementing AES-GSM, that's just for better understanding of that stuff, nothing more. Well I ...
2
votes
1answer
78 views

GCM mode of operation and IV size less 96 bits

GCM specification defines the initial counter value $Y_0$ for encryption/decryption operations as follows: $$ Y_0=\begin{cases} IV||0^{31}1 &\text{if len}(IV)=96\\ GHASH(H,\{\},IV)& \text{...
1
vote
2answers
151 views

Is it safe to use a counter as IV for AES256-GCM

What if I will use 96-bit integer counter starting from 0 as IV for AES256-GCM cipher. Is it safe? Is there any other ways to ensure uniqueness of IV for GCM cipher?
1
vote
2answers
69 views

Is the key safe if attacker know the encrypted and decrypted message?

Given an attacker know both the encrypted message (+ an iv) and the equivalent decrypted message, is it possible for him to craft a new encrypted message that could result in a desired decrypted ...
2
votes
1answer
94 views

Why is GCM not vulnerable at the birthday bound for 128 bit IV?

According to this article, which looks at attacks on Caesar candidates beyond what they claim, they include an attack on page 6 for nonce-respecting adversaries for AES-GCM which allows IVs longer ...
1
vote
1answer
87 views

It's safe to store a known value (for checking) next to the actually encrypted values

The high level details of the encryption I'm using is: AndroidKeyStore create/store RSA key AES key is created and wrapped with RSA/ECB/PKCS1Padding Encrypted AES is saved to disk. Data is encrypted ...
0
votes
1answer
103 views

Good practices for AES key derivation and management

I'm developping a device based on STM32L4x6. It is connected through BLE to a smartphone and it exchanges encrypted data with it. Data consists of health data of patients. Encryption is AES-GCM 256 ...
0
votes
2answers
228 views

Which is slower, AES or GCM hash (GHASH), if CPU has no special instructions?

In an answer to this question: Security of GCM if Implemented with Stream Cipher instead of Block Cipher ...it was stated that: The GHASH part of GCM is usually the problematic one when it comes to ...
7
votes
1answer
745 views

TLS 1.2 Cipher Suites With AES-GCM – What data (if any) is passed to the AES-GCM cipher as the Additional Authentication Data?

TLS 1.2 defines a number of cipher suites that employ AES-GCM, e.g.: ...
0
votes
2answers
216 views

Key wrapping - encrypting many times with AES-GCM

When encrypting many short plaintexts with a single key, lets say about 2^64 total plaintexts at under 64 bytes each: (edit note - was 2^70 in the original question) Is there a way to use AES-GCM, as ...
1
vote
1answer
37 views

Will AES-GCM smaller sized tag (mac) be included in larger sized tag

I want to make sure that I understand AES-GCM correctly: If I have: key1, plaintext1, iv1, adata1 and requset tag size of 96 bits, and tag size of 128 bits, will the first 12 bytes of the 128 bits ...
0
votes
2answers
594 views

Appropriate key for AES 256 GCM

I am updating a system that has Rails' OpenSSL on one side and Python's cryptography.io on the other. The Rails side has to generate keys for the AES-256-GCM and here are two methods that appear to ...
8
votes
2answers
1k views

Can AES-GCM be broken if initialisation vector is known?

We are using AES encryption in GCM block mode in order to encrypt a number of different kinds of data at rest on a mobile device - Android. The key used for encryption is stored in the protected key-...
0
votes
1answer
26 views

Can sending the same plaintext twice, each encrypted with different key and IV, weaken the encryption?

I'm basing code on: https://wiki.openssl.org/index.php/EVP_Authenticated_Encryption_and_Decryption#Authenticated_Encryption_using_GCM_mode If I send the same plaintext twice, encrypting each with a ...
4
votes
2answers
238 views

Is it possible to recover AES-GCM plaintext when having everything but the additional data?

I'm using the window.crypto library in browsers. I use iv from window.crypto.getRandomValues...
6
votes
2answers
292 views

IV in Galois Counter Mode

I am looking at Wikepedia Galois Counter Mode article. I see this diagram I am trying to figure out where the IV works its way in. Is it used to initialize the counter? If so, how does a sequence of ...
3
votes
0answers
232 views

Why is counter mode encryption with a 16-byte cipher block not broken?

We determine a system IND-CPA secure when an adversary has a negligible advantage after any feasible amount of queries. AES256-GCM uses a 128bit block cipher. We know that the distinguishability ...
0
votes
1answer
750 views

Difference between AES-GCM encryption in dotnet and Node.js [closed]

I have a big problem about encryption with AES-GCM. Between using dotnet and Node.js, the encryption results are slightly different. Here is the code in Node.js from JOSE using Crypto Library : <...
1
vote
1answer
84 views

What does GHASH really do?

I try to understand the GCM-MODE used in TLS. The problem I have had is described below. 1:textbook describes how GHASH works: 2: I get some debuginfo from openssl code that contain enc_key(32 bytes)...
0
votes
0answers
312 views

Preventing replay attacks in a Web API that uses AES256

Background I am creating a Web API where both the request parameters and the response body are encrypted using AES-256-GCM. Vulnerability However, it is vulnerable to replay attacks. If someone ...
2
votes
1answer
733 views

AES 128 GCM - dynamic key with static IV/nonce

I'm working on a project to upgrade an existing system that currently uses RC4 to encrypt a payload with a random session key. The session key is then encrypted with asymmetric public key encryption (...
1
vote
2answers
273 views

Deciding on an AES cipher mode for chunked data

I'm trying to decide on which ciphermode to use for a programming excercise. I have a file that I need to encrypt without saving unencrypted data to storage and without storing the entire file in ...
2
votes
3answers
303 views

Why this complexity defining AES-GCM counter block?

AES-GCM counter block is defined as nonce || IV || counter. Why this complexity? Knowing that it does not need to be secret and its only required property is to be ...
3
votes
0answers
130 views

Add authenticated encryption additional data (AEAD) to data encryption key (DEK)?

When using a DEK to encrypt data using envelope encryption do you need to add AEAD to the DEK itself? I would think that it is unnecessary because bit flipping attacks are useless against a DEK and ...
1
vote
1answer
147 views

Is using ECDSA with AES-GCM viable?

I'm pretty new to the whole cryptography scene, so please forgive me if I make any incorrect statements. I have a 16MB image that I'm encrypting and authenticating using AES-GCM. I obtain a 16MB ...
6
votes
1answer
110 views

Is this a typo/error in the Galois/Counter mode specification or have I misunderstood?

I've been reading the following document describing Galois Counter Mode: The Galois/Counter Mode of Operation On page 7 of the document, the following diagram describes the ...