Questions tagged [aes-gcm]
Deprecated tag, see tag info. Advanced Encryption Standard Galois/Counter Mode, better known as AES-GCM is a mode of operation for symmetric key cryptographic block ciphers that has been widely adopted because of its efficiency and performance. GCM supports authenticated encryption, meaning that the mode not only offers privacy, but also integrity.
211
questions
0
votes
0
answers
89
views
Cryptographic strength of AES-GCM-256 for classical and Quantum
How can the strength be calculated, of both the GMAC and the encryption for AES-GCM-256, with AES key of 256 bit, for classical and quantum computers?
- 13k
2
votes
1
answer
1k
views
How long does it take to decrypt AES encrypted message with salt(for pbkdf2 key) and iv known
I'm new to crypto!
The situation is,
Aes-256-cbc encrypted message(including not encrypted iv & salt) is revealed.
We also know pbkdf2 function uses 10000 rounds with sha256.
All we need to ...
- 103
1
vote
1
answer
292
views
Multiple Encryption Using GCM For Multi-Key Security
Multiple Encryption For Multi-Key Security
I have a hypothetical question about multiple encryption after reading Matthew Green’s blog on multiple encryption. For those who are familiar with GCM…I ...
CommunityBot
- 1
5
votes
1
answer
178
views
New NIST Journey: Accordion Cipher Mode
NIST recently unveiled the criteria for crafting a new block cipher mode of operation for AES called Accordion Cipher Mode. Simultaneously, they've announced Ascon as the Winner in the Lightweight ...
- 46
0
votes
1
answer
57
views
Can I prove AES-GCM nonce reuse just from the bytes?
I have AES-GCM output with GMAC tag. The plaintext consists of some bitfields I know the structure of. When I generate input which should only affect timestamps and counters in very specific bytes, I ...
- 147k
0
votes
1
answer
95
views
Do I need to use unique IVs if all encrypted data is unique?
I am designing a service where each user has both a unique 256-bit private and public ID. These IDs should be derivable from one another, but only within the backend of my service (as to not expose ...
- 147k
0
votes
1
answer
109
views
What exactly is RSA_WITH_AES256_CBC_SHA256?
Quick disclaimer, I am pretty new to cryptography. I only understand the basics of asymmetric and symmetric encryption. In particular, RSA and AES.
I have a project where my service is receiving an ...
- 92.6k
0
votes
0
answers
61
views
What should be passed as the authentication tag when creating a SealedBox? And can it be made public?
When creating a SealedBox, one of the parameters which needs to be passed is an authentication tag:
https://developer.apple.com/documentation/cryptokit/aes/gcm/...
0
votes
0
answers
29
views
Seeking Guidance on Building Isomorphic Matrices for AES GCM in Composite Fields
I'm a beginner in cryptography, currently focusing on AES GCM, specifically the GF(2^128) multiplier which employs the irreducible polynomial x^128 + x^7 + x^2 + x + 1. I try to explore the ...
- 1
1
vote
1
answer
85
views
What does "192-bit equivalent" mean for WPA3?
In the Wikipedia page for WPA3 enterprise mode, it states that WPA3 has an "...equivalent 192-bit cryptographic strength in WPA3-Enterprise mode..." yet it also says that it uses AES-256-GCM ...
- 3,361
1
vote
1
answer
126
views
Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit, why Not 2^39 [duplicate]
While examining the initial GCM specification by McGrew and Viega in 2005, it appears that the formation of the 128-bit Initialization Vector by combining a 96-bit nonce and a 32-bit unsigned wrapping ...
- 92.6k
1
vote
0
answers
65
views
Weaknesses of AES-GCM [duplicate]
Besides the limited nonce size of 96 bits, are there any other weaknesses to the GCM mode of AES?
I am creating a password vault and am trying to narrow down my options of encryption schemes.
Also, is ...
- 11
3
votes
2
answers
2k
views
Using AES-GCM (or AEAD ciphers in general) as a pure MAC without encryption
What's the opinion on using an AEAD cipher such as AES-GCM for example as a pure message authentication code (MAC) when only message authentication but not encryption is required.
does it bring any ...
0
votes
0
answers
48
views
Using AEAD as pure MAC with *only* associated data? [duplicate]
Authenticated Encryption with Associated Data (AEAD), such as AES-GCM, is a form of encryption that has a "built-in" integrity verification. This means that if the encrypted message is ...
0
votes
1
answer
80
views
Nonce reuse in GMAC without ciphertext (only AAD)
As we all know, nonce reuse in AES/GCM can easily be catastrophic.
However, I'm wondering if the same risks are present if an adversary has access to:
Ciphertext and corresponding MAC of one message
...
- 147k
0
votes
1
answer
71
views
Can we have an asymmetric key in AES? Clarification about PBKDF2 and AES-GCM in WebCrypto
Can we have an asymmetric key in AES? Clarification about PBKDF2 and AES-GCM in WebCrypto
According to wikipedia AES page, AES is a symmetric-key algorithm.
The algorithm described by AES is a ...
- 48.5k
4
votes
0
answers
108
views
Masking countermeasures for AES-GCM
Suppose I have a masked AES encryption $AES(\oplus_i K_i, \oplus_i P_i)=\oplus_i C_i$, i.e. the key, plaintext, and resulting ciphertext are tuples $K_i$, $P_i$, and $C_i$ that sum to $K$, $P$, and $C$...
- 421
0
votes
0
answers
88
views
Is it possible to uncover the plaintext if IV is used twice but the key is different?
I am currently working on a cryptography challenge. The program uses AES-GCM to encrypt and decrypt strings.
Let's say I have the following:
IV which is reused
only 1 cipher text
authentication tag
...
- 101
0
votes
2
answers
247
views
ChaCha20-Poly1305 and AES-GCM-SIV output size
Background information:
I need to encrypt 168bit messages, the ciphertext should, preferably, match the plaintext size. Message Authentication and Integrity is not a must, but a really important ...
- 48.5k
2
votes
2
answers
983
views
Obsidian.md's "end-to-end" encryption & privacy
Obsidian.md claims
End-to-end encryption means that the data is encrypted from the moment it leaves your device, and can only be decrypted using your encryption key once it's back on one of your ...
- 160
0
votes
1
answer
205
views
AES-GCM vulnerabilities
Does AES-GCM take replay attacks into consideration?
If an attacker intercepts the AES-GCM secured message and gains access to the initialization vector (IV), can they inject falsely fabricated data (...
- 147k
0
votes
1
answer
64
views
AES-GCM across multiple packets
I am just getting started with cryptography.
After doing some research, I see that people usually advice against encryption using the same key and nonce. However if a message is too long and has to be ...
- 9,207
0
votes
1
answer
30
views
AES GCM representation of lev(IV) in IV padding to compute ICB
I have a question regarding understanding representation of length in AES-GCM while doing padding for the IV to calculate ICB/J0.
In the aes GCM test vectors testcase5 I see the IV is of length 8 ...
- 92.6k
0
votes
1
answer
87
views
1
vote
1
answer
91
views
DTLS 1.2 Cipher Suites With AES-GCM – What data (if any) is passed to the AES-GCM cipher as the Additional Authentication Data?
It is DTLS 1.2 version question of this question.
I know from 4.1.2.4. of RFC 5246 (DTLS 1.2) AEAD Ciphers can be used in DTLS 1.2 exactly the same with TLS 1.2.
In TLS 1.2
AAD = seq_num + ...
3
votes
2
answers
876
views
Encrypting arbitrary large files in AEAD chunks - how to protect against chunk reordering?
I would like to encrypt big files using an authenticated cipher. I am convinced to use approach where file is divided into smaller manageable chunks that fit easily in memory (e.g. 1-10MB size) which ...
- 1,803
1
vote
1
answer
557
views
How does AES-GCM and AES-CCM provide authenticity?
My lecture notes state that of the AES operating modes ECB, CBC, CTR, CCM (CTR+CBC MAC) and GCM, only CCM and GCM provide authenticity.
In CCM, as I understand it, the authenticity lies in the MAC, i....
- 3,361
3
votes
1
answer
196
views
Does HMAC provide anything that AES GCM does not?
I would like to let the receiver has the ability to check the sender's authenticity when he gets the message.
Also, I want to protect the message's confidentiality and integrity.
Should I use ...
- 147k
1
vote
1
answer
180
views
Where in the TLS 1.3 record is the sequence number located?
The sequence number should be a 64 bit number in every TLS record, but the record header layer is only 5 bytes long and I am looking at a Wireshark pcap, where the TLS record only includes the header ...
- 23.8k
0
votes
1
answer
52
views
Why is IV in RFC8448 examples only 12 octets instead of 16?
I am working on manual decryption of application data in TLS 1.3 by going through example in RFC8448. I successfully derived and expanded key and IV, but the IV in examples is only 12 bytes long ...
- 147k
0
votes
0
answers
51
views
Question about Asymmetric key wrapping using (limited) AES-GCM
assuming that I have an RSA key of length 4k bit which I'm interested to wrap using AES-GCM, and I have a (limited) AES-GCM cipher which can only encrypt limited input in size (say 256-bit/512-bit ...
- 1
1
vote
0
answers
87
views
AES-GCM for sensitive database field - good solution?
I have been researching the best encryption to use in a .NET application for managing a sensitive database field (column). This encryption is on top of e.g. AWS at-rest encryption applied to the whole ...
- 11
1
vote
2
answers
184
views
decrypting full ciphertext of (AES CTR/GCM) based on partial knowledge of the cleartext
I have found myself in a position where I need to encrypt multiple objects (vCards) with AES Counter mode or Galois/Counter Mode using the same key. Now here is the problem the structure of the vCard ...
2
votes
0
answers
94
views
Safety of reusing same seed to derive secp256k1 keys and AES-256-GCM
The use case here is to deterministically generate a multi-use wallet from a single 12-word BIP39 mnemonic. Currently a standard process for deriving secp256k1 keypairs is implemented, e.g., using a ...
- 21
2
votes
1
answer
348
views
Cipher Text generated is different if nonce is greater than 12 bytes
I wrote a library which uses AES-GCM-128 to perform encrypt and decrypt operations. This library uses EVP functions that provide a high level interface to OpenSSL cryptographic functions.
To verify my ...
- 1
4
votes
3
answers
5k
views
AES-GCM conformance test
Is there any conformance tests/sequences to validate AES-GCM & GHASH() implementation?
Details: I'm implementing AES-GSM, that's just for better understanding of that stuff, nothing more. Well I ...
- 103
3
votes
1
answer
113
views
What kind of hashing is GF multiplication in GCM cipher mode and GMAC?
In GCM, GMAC, the additional associated data (AAD) (as well as outputs of subsequent blocks) is multiplied by a polynomial H in GF(2^128). This appears to be doing some secure hashing.
Is that what's ...
- 9,207
2
votes
1
answer
336
views
Is it possible to reverse GHASH from GCM?
How can I create a "reverse" GHASH algorithm for GCM that allows me to compute an input value that generates a specific chosen output, given that I know the authentication key H? If this is ...
- 2,595
3
votes
1
answer
99
views
GCM-SIV vs CBC with fixed IV?
I keep hearing CBC with fixed IV mode is bad because it has similar issues to the codebook breakdown of ECB mode. However, people seem quite willing to recommend AES-GCM-SIV for deterministic ...
- 141k
0
votes
1
answer
134
views
Implementing AES GCM but not getting correct output from cipher block
I'm implementing 128-bit AES-GCM (but only the encryption/AES-CTR aspect).
When I set the Secret Key, Plaintext and IV to Test Case 2, page 27 of the GCM spec (see below) I get the wrong value for the ...
- 147k
0
votes
1
answer
125
views
AES GCM Difference between the IV and the Secret Key?
Below is part of AES GCM diagram. However, it only shows the behavior of the IV/counter.
The GCM specification examples state both an IV and a Secret Key as two inputs.
Can someone please explain ...
- 147k
1
vote
1
answer
95
views
Drawbacks of multiple sources of entropy for AES
Since AES needs IV to be random (unless fed by a unit test), I was wondering how to properly handle it.
I know that Intel/AMD now supports the rdrand64 function but ...
- 2,611
4
votes
2
answers
2k
views
OpenSSL AES-GCM says 'bad decrypt', other block modes work fine?
If I do a simple encrypt and decrypt test like so:
...
- 2,611
1
vote
1
answer
367
views
AES256-GCM padding for unaligned blocks
So I found some test vectors for my SSE implementation of AES256-GCM and unfortunately it seems that after the last step of AAD it goes wrong. My guess is that this is because the AAD is actually ...
- 147k
2
votes
1
answer
838
views
AES-GCM with HMAC
I am using AES-GCM to encrypt some data. I want every encryption to be done with a new random iv. For every encryption a new iv is generated and appended to the encrypted text to produce the cipher. ...
- 92.6k
2
votes
1
answer
1k
views
How can AES-CCM behave as an AEAD stream cipher?
AESCCM- Couter with Cipher Block Chaining Message.
As it uses cmac for generation for tag , which is internally aes-cbc (block cipher, need block size, may require padding) And Encryption is done ...
- 92.6k
2
votes
1
answer
1k
views
Understanding AES-GCM IV (Nonce), Tag/MAC, Message & Transmission
I am working on a project that uses PAKE (SRP) for authentication. When we send the M1 to the server we are encrypting the payload using AES-GCM. I mention SRP only to set the context:
A message is ...
- 92.6k
2
votes
1
answer
920
views
What does AES-GCM provide?
I am wondering does AES-GCM which uses Authenticated Encryption provide us with all 3 properties (Authenticity, Confidentiality, and Integrity), or does it not provide integrity?
- 48.5k
1
vote
0
answers
62
views
Should I encrypt individual columns or all data?
I want to AES-GCM some user data that I‘m going to persist in a database. I‘m wondering if I should encrypt individual columns (all with an individual IV ofc) or JSON stringify the sensitive data and ...
- 111
1
vote
1
answer
424
views
How are long IVs used in AES-GCM?
I looked through NIST's official test vectors (CAVP) for the AES-GCM mode, and noticed that there are some test vectors in there with 8-bit or 1024-bit IVs. But as far as I understand, the GCM ...
- 167