Questions tagged [aes-gcm]
Deprecated tag, see tag info. Advanced Encryption Standard Galois/Counter Mode, better known as AES-GCM is a mode of operation for symmetric key cryptographic block ciphers that has been widely adopted because of its efficiency and performance. GCM supports authenticated encryption, meaning that the mode not only offers privacy, but also integrity.
203
questions
1
vote
1
answer
102
views
Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit, why Not 2^39 [duplicate]
While examining the initial GCM specification by McGrew and Viega in 2005, it appears that the formation of the 128-bit Initialization Vector by combining a 96-bit nonce and a 32-bit unsigned wrapping ...
- 21
1
vote
0
answers
65
views
Weaknesses of AES-GCM [duplicate]
Besides the limited nonce size of 96 bits, are there any other weaknesses to the GCM mode of AES?
I am creating a password vault and am trying to narrow down my options of encryption schemes.
Also, is ...
- 11
0
votes
0
answers
48
views
Using AEAD as pure MAC with *only* associated data? [duplicate]
Authenticated Encryption with Associated Data (AEAD), such as AES-GCM, is a form of encryption that has a "built-in" integrity verification. This means that if the encrypted message is ...
0
votes
1
answer
57
views
Nonce reuse in GMAC without ciphertext (only AAD)
As we all know, nonce reuse in AES/GCM can easily be catastrophic.
However, I'm wondering if the same risks are present if an adversary has access to:
Ciphertext and corresponding MAC of one message
...
- 101
0
votes
1
answer
56
views
Can we have an asymmetric key in AES? Clarification about PBKDF2 and AES-GCM in WebCrypto
Can we have an asymmetric key in AES? Clarification about PBKDF2 and AES-GCM in WebCrypto
According to wikipedia AES page, AES is a symmetric-key algorithm.
The algorithm described by AES is a ...
- 101
4
votes
0
answers
86
views
Masking countermeasures for AES-GCM
Suppose I have a masked AES encryption $AES(\oplus_i K_i, \oplus_i P_i)=\oplus_i C_i$, i.e. the key, plaintext, and resulting ciphertext are tuples $K_i$, $P_i$, and $C_i$ that sum to $K$, $P$, and $C$...
- 367
0
votes
0
answers
83
views
Is it possible to uncover the plaintext if IV is used twice but the key is different?
I am currently working on a cryptography challenge. The program uses AES-GCM to encrypt and decrypt strings.
Let's say I have the following:
IV which is reused
only 1 cipher text
authentication tag
...
- 101
0
votes
2
answers
127
views
ChaCha20-Poly1305 and AES-GCM-SIV output size
Background information:
I need to encrypt 168bit messages, the ciphertext should, preferably, match the plaintext size. Message Authentication and Integrity is not a must, but a really important ...
- 43
2
votes
2
answers
430
views
Obsidian.md's "end-to-end" encryption & privacy
Obsidian.md claims
End-to-end encryption means that the data is encrypted from the moment it leaves your device, and can only be decrypted using your encryption key once it's back on one of your ...
- 21
0
votes
1
answer
112
views
AES-GCM vulnerabilities
Does AES-GCM take replay attacks into consideration?
If an attacker intercepts the AES-GCM secured message and gains access to the initialization vector (IV), can they inject falsely fabricated data (...
- 1
0
votes
1
answer
46
views
AES-GCM across multiple packets
I am just getting started with cryptography.
After doing some research, I see that people usually advice against encryption using the same key and nonce. However if a message is too long and has to be ...
0
votes
1
answer
25
views
AES GCM representation of lev(IV) in IV padding to compute ICB
I have a question regarding understanding representation of length in AES-GCM while doing padding for the IV to calculate ICB/J0.
In the aes GCM test vectors testcase5 I see the IV is of length 8 ...
- 357
0
votes
1
answer
67
views
1
vote
1
answer
52
views
DTLS 1.2 Cipher Suites With AES-GCM – What data (if any) is passed to the AES-GCM cipher as the Additional Authentication Data?
It is DTLS 1.2 version question of this question.
I know from 4.1.2.4. of RFC 5246 (DTLS 1.2) AEAD Ciphers can be used in DTLS 1.2 exactly the same with TLS 1.2.
In TLS 1.2
AAD = seq_num + ...
- 13
3
votes
2
answers
692
views
Encrypting arbitrary large files in AEAD chunks - how to protect against chunk reordering?
I would like to encrypt big files using an authenticated cipher. I am convinced to use approach where file is divided into smaller manageable chunks that fit easily in memory (e.g. 1-10MB size) which ...
- 133
1
vote
1
answer
230
views
How does AES-GCM and AES-CCM provide authenticity?
My lecture notes state that of the AES operating modes ECB, CBC, CTR, CCM (CTR+CBC MAC) and GCM, only CCM and GCM provide authenticity.
In CCM, as I understand it, the authenticity lies in the MAC, i....
- 11
3
votes
1
answer
149
views
Does HMAC provide anything that AES GCM does not?
I would like to let the receiver has the ability to check the sender's authenticity when he gets the message.
Also, I want to protect the message's confidentiality and integrity.
Should I use ...
- 43
1
vote
1
answer
109
views
Where in the TLS 1.3 record is the sequence number located?
The sequence number should be a 64 bit number in every TLS record, but the record header layer is only 5 bytes long and I am looking at a Wireshark pcap, where the TLS record only includes the header ...
- 113
0
votes
1
answer
46
views
Why is IV in RFC8448 examples only 12 octets instead of 16?
I am working on manual decryption of application data in TLS 1.3 by going through example in RFC8448. I successfully derived and expanded key and IV, but the IV in examples is only 12 bytes long ...
- 113
0
votes
0
answers
48
views
Question about Asymmetric key wrapping using (limited) AES-GCM
assuming that I have an RSA key of length 4k bit which I'm interested to wrap using AES-GCM, and I have a (limited) AES-GCM cipher which can only encrypt limited input in size (say 256-bit/512-bit ...
- 1
1
vote
0
answers
76
views
AES-GCM for sensitive database field - good solution?
I have been researching the best encryption to use in a .NET application for managing a sensitive database field (column). This encryption is on top of e.g. AWS at-rest encryption applied to the whole ...
- 11
1
vote
2
answers
136
views
decrypting full ciphertext of (AES CTR/GCM) based on partial knowledge of the cleartext
I have found myself in a position where I need to encrypt multiple objects (vCards) with AES Counter mode or Galois/Counter Mode using the same key. Now here is the problem the structure of the vCard ...
- 153
2
votes
0
answers
85
views
Safety of reusing same seed to derive secp256k1 keys and AES-256-GCM
The use case here is to deterministically generate a multi-use wallet from a single 12-word BIP39 mnemonic. Currently a standard process for deriving secp256k1 keypairs is implemented, e.g., using a ...
- 21
3
votes
1
answer
108
views
What kind of hashing is GF multiplication in GCM cipher mode and GMAC?
In GCM, GMAC, the additional associated data (AAD) (as well as outputs of subsequent blocks) is multiplied by a polynomial H in GF(2^128). This appears to be doing some secure hashing.
Is that what's ...
- 117
2
votes
1
answer
317
views
Is it possible to reverse GHASH from GCM?
How can I create a "reverse" GHASH algorithm for GCM that allows me to compute an input value that generates a specific chosen output, given that I know the authentication key H? If this is ...
- 29
3
votes
1
answer
82
views
GCM-SIV vs CBC with fixed IV?
I keep hearing CBC with fixed IV mode is bad because it has similar issues to the codebook breakdown of ECB mode. However, people seem quite willing to recommend AES-GCM-SIV for deterministic ...
- 31
0
votes
1
answer
82
views
Implementing AES GCM but not getting correct output from cipher block
I'm implementing 128-bit AES-GCM (but only the encryption/AES-CTR aspect).
When I set the Secret Key, Plaintext and IV to Test Case 2, page 27 of the GCM spec (see below) I get the wrong value for the ...
- 117
0
votes
1
answer
91
views
AES GCM Difference between the IV and the Secret Key?
Below is part of AES GCM diagram. However, it only shows the behavior of the IV/counter.
The GCM specification examples state both an IV and a Secret Key as two inputs.
Can someone please explain ...
- 117
1
vote
1
answer
85
views
Drawbacks of multiple sources of entropy for AES
Since AES needs IV to be random (unless fed by a unit test), I was wondering how to properly handle it.
I know that Intel/AMD now supports the rdrand64 function but ...
- 23
1
vote
1
answer
221
views
AES256-GCM padding for unaligned blocks
So I found some test vectors for my SSE implementation of AES256-GCM and unfortunately it seems that after the last step of AAD it goes wrong. My guess is that this is because the AAD is actually ...
- 23
4
votes
2
answers
2k
views
OpenSSL AES-GCM says 'bad decrypt', other block modes work fine?
If I do a simple encrypt and decrypt test like so:
...
- 1,397
2
votes
1
answer
589
views
AES-GCM with HMAC
I am using AES-GCM to encrypt some data. I want every encryption to be done with a new random iv. For every encryption a new iv is generated and appended to the encrypted text to produce the cipher. ...
- 21
2
votes
1
answer
832
views
Understanding AES-GCM IV (Nonce), Tag/MAC, Message & Transmission
I am working on a project that uses PAKE (SRP) for authentication. When we send the M1 to the server we are encrypting the payload using AES-GCM. I mention SRP only to set the context:
A message is ...
- 123
2
votes
1
answer
600
views
What does AES-GCM provide?
I am wondering does AES-GCM which uses Authenticated Encryption provide us with all 3 properties (Authenticity, Confidentiality, and Integrity), or does it not provide integrity?
- 161
1
vote
1
answer
1k
views
How long does it take to decrypt AES encrypted message with salt(for pbkdf2 key) and iv known
I'm new to crypto!
The situation is,
Aes-256-cbc encrypted message(including not encrypted iv & salt) is revealed.
We also know pbkdf2 function uses 10000 rounds with sha256.
All we need to ...
- 11
1
vote
0
answers
59
views
Should I encrypt individual columns or all data?
I want to AES-GCM some user data that I‘m going to persist in a database. I‘m wondering if I should encrypt individual columns (all with an individual IV ofc) or JSON stringify the sensitive data and ...
- 111
0
votes
0
answers
287
views
Decryption failure for NIST vector AES-CBC-128
I am learning/exploring the openssl library for encrypting and decrypting data
while encryption goes through fine I see standalone decryption not working as I expected.
The test vector I am using is
<...
- 1
1
vote
1
answer
383
views
How are long IVs used in AES-GCM?
I looked through NIST's official test vectors (CAVP) for the AES-GCM mode, and noticed that there are some test vectors in there with 8-bit or 1024-bit IVs. But as far as I understand, the GCM ...
- 201
0
votes
1
answer
626
views
What is the use of Additional data or associated data in AESGcm. How it is used while encryption and decryption [closed]
I am trying to understand the AESGcm encryption and decryption and there's one field associated data in Encryption and Decryption methods.
https://learn.microsoft.com/en-us/dotnet/api/system.security....
1
vote
0
answers
90
views
Using a signature as key material
I am designing my first web3 app and I would like to use MetaMask as an identity and crypto provider. My web3 app will encrypt user data with AES-GCM, but I do not want to generate and store an ...
- 11
1
vote
1
answer
90
views
Is MAC unnecessary for client side encryption?
In my open source with offline client side encryption application, I plan to use AES-CTR or ChaCha20 without MAC instead of GCM or Poly1305 since:
There is no database, the ciphertext, nonce, tag ...
- 155
0
votes
2
answers
930
views
How is AES256-GCM auth tag used in decryption
I have been playing with AES256-GCM in NodeJS crypto library and it shows that the original message can be decrypted without caring about the auth tag.
So can a non-tag verified decryption be secure? ...
- 155
0
votes
1
answer
1k
views
How is AES-GCM IV and auth tag used?
I have been learning about AES-GCM and AES in general lately and founding:
The key is the secret and both sender and receiver keep it hidden forever.
The IV and auth tag are public and sent along with ...
- 155
1
vote
1
answer
587
views
Aes-Gcm how to perform decryption authentication without plaintext output in C#
I'm mainly trying to verify large file chunks which are encrypted each alone with a different key/salt/nonce for each chunk then appended to the whole file in the end to form 1 file.
One thing I ...
- 23
1
vote
1
answer
7k
views
How does AES GCM encryption work
Previously, I used AES CBC 256 with 256 bit key and 128 bit IV.
However it seems slow so I decide to switch to AES GCM 256 bit key, 96 bit IV which has some parts I don't understand such as:
Auth tag:...
- 155
1
vote
2
answers
397
views
Argon2id creating key for cryptography, how acceptable is it to use the same salt for the same encryption operation?
Everyone knows Argon2id is a slow hashing algorithm, and that's on purpose, all is good.
When creating an Argon2id object a lot of parameters are needed to be taken into consideration ultimately ...
- 23
1
vote
2
answers
854
views
Does the AES-GCM specification require the tag-size to be bound to the GCM context?
Does GCM spec (NIST SP 800-38D) require tag-size to be fixed for an instance of GCM algorithm (which usually fixes a specific GCM key)?
Asked differently, is the following a legitimate adherence to ...
- 43
0
votes
0
answers
87
views
Encrypt user AES keys with AWS KMS RSA key
I am developing a web application in which each user has some part of his data that is stored encrypted. We are hosted on AWS and I want to use KMS as part of the solution. To not make the solution ...
- 1
3
votes
1
answer
175
views
AES-GCM with different IVs but close enough for counter to cause duplicates
I am planning to use AES-GCM or AES-CTR for encryption. However, I have read from several sources that the IVs must be unique for every piece of information encrypted. I have a doubt though, what if I ...
- 33
1
vote
1
answer
720
views
Using AES-256-GCM, is your security only 128 bits when solely relying on the MAC?
Since the maximum authentication tag (MAC) size of AES-256-GCM is 16 bytes,
And given that in one implementation, that breaking the MAC would break the security (ex. when a boolean 'decrypted' is used ...
- 293