Questions tagged [aes-gcm]
Deprecated tag, see tag info. Advanced Encryption Standard Galois/Counter Mode, better known as AES-GCM is a mode of operation for symmetric key cryptographic block ciphers that has been widely adopted because of its efficiency and performance. GCM supports authenticated encryption, meaning that the mode not only offers privacy, but also integrity.
187
questions
1
vote
1
answer
41
views
Where in the TLS 1.3 record is the sequence number located?
The sequence number should be a 64 bit number in every TLS record, but the record header layer is only 5 bytes long and I am looking at a Wireshark pcap, where the TLS record only includes the header ...
- 20.2k
0
votes
1
answer
43
views
Why is IV in RFC8448 examples only 12 octets instead of 16?
I am working on manual decryption of application data in TLS 1.3 by going through example in RFC8448. I successfully derived and expanded key and IV, but the IV in examples is only 12 bytes long ...
- 140k
0
votes
0
answers
42
views
Question about Asymmetric key wrapping using (limited) AES-GCM
assuming that I have an RSA key of length 4k bit which I'm interested to wrap using AES-GCM, and I have a (limited) AES-GCM cipher which can only encrypt limited input in size (say 256-bit/512-bit ...
- 1
1
vote
0
answers
37
views
AES-GCM for sensitive database field - good solution?
I have been researching the best encryption to use in a .NET application for managing a sensitive database field (column). This encryption is on top of e.g. AWS at-rest encryption applied to the whole ...
- 11
1
vote
2
answers
65
views
decrypting full ciphertext of (AES CTR/GCM) based on partial knowledge of the cleartext
I have found myself in a position where I need to encrypt multiple objects (vCards) with AES Counter mode or Galois/Counter Mode using the same key. Now here is the problem the structure of the vCard ...
2
votes
0
answers
62
views
Safety of reusing same seed to derive secp256k1 keys and AES-256-GCM
The use case here is to deterministically generate a multi-use wallet from a single 12-word BIP39 mnemonic. Currently a standard process for deriving secp256k1 keypairs is implemented, e.g., using a ...
- 21
2
votes
1
answer
266
views
Cipher Text generated is different if nonce is greater than 12 bytes
I wrote a library which uses AES-GCM-128 to perform encrypt and decrypt operations. This library uses EVP functions that provide a high level interface to OpenSSL cryptographic functions.
To verify my ...
- 1
4
votes
3
answers
4k
views
AES-GCM conformance test
Is there any conformance tests/sequences to validate AES-GCM & GHASH() implementation?
Details: I'm implementing AES-GSM, that's just for better understanding of that stuff, nothing more. Well I ...
- 103
3
votes
1
answer
87
views
What kind of hashing is GF multiplication in GCM cipher mode and GMAC?
In GCM, GMAC, the additional associated data (AAD) (as well as outputs of subsequent blocks) is multiplied by a polynomial H in GF(2^128). This appears to be doing some secure hashing.
Is that what's ...
- 8,291
1
vote
1
answer
178
views
Multiple Encryption Using GCM For Multi-Key Security
Multiple Encryption For Multi-Key Security
I have a hypothetical question about multiple encryption after reading Matthew Green’s blog on multiple encryption. For those who are familiar with GCM…I ...
CommunityBot
- 1
2
votes
1
answer
242
views
Is it possible to reverse GHASH from GCM?
How can I create a "reverse" GHASH algorithm for GCM that allows me to compute an input value that generates a specific chosen output, given that I know the authentication key H? If this is ...
- 2,542
3
votes
1
answer
58
views
GCM-SIV vs CBC with fixed IV?
I keep hearing CBC with fixed IV mode is bad because it has similar issues to the codebook breakdown of ECB mode. However, people seem quite willing to recommend AES-GCM-SIV for deterministic ...
- 134k
0
votes
1
answer
49
views
Implementing AES GCM but not getting correct output from cipher block
I'm implementing 128-bit AES-GCM (but only the encryption/AES-CTR aspect).
When I set the Secret Key, Plaintext and IV to Test Case 2, page 27 of the GCM spec (see below) I get the wrong value for the ...
- 140k
0
votes
1
answer
51
views
AES GCM Difference between the IV and the Secret Key?
Below is part of AES GCM diagram. However, it only shows the behavior of the IV/counter.
The GCM specification examples state both an IV and a Secret Key as two inputs.
Can someone please explain ...
- 140k
1
vote
1
answer
63
views
Drawbacks of multiple sources of entropy for AES
Since AES needs IV to be random (unless fed by a unit test), I was wondering how to properly handle it.
I know that Intel/AMD now supports the rdrand64 function but ...
- 2,573
4
votes
2
answers
1k
views
OpenSSL AES-GCM says 'bad decrypt', other block modes work fine?
If I do a simple encrypt and decrypt test like so:
...
- 2,573
1
vote
1
answer
74
views
AES256-GCM padding for unaligned blocks
So I found some test vectors for my SSE implementation of AES256-GCM and unfortunately it seems that after the last step of AAD it goes wrong. My guess is that this is because the AAD is actually ...
- 140k
2
votes
1
answer
307
views
AES-GCM with HMAC
I am using AES-GCM to encrypt some data. I want every encryption to be done with a new random iv. For every encryption a new iv is generated and appended to the encrypted text to produce the cipher. ...
- 90.2k
2
votes
1
answer
897
views
How can AES-CCM behave as an AEAD stream cipher?
AESCCM- Couter with Cipher Block Chaining Message.
As it uses cmac for generation for tag , which is internally aes-cbc (block cipher, need block size, may require padding) And Encryption is done ...
- 90.2k
2
votes
1
answer
385
views
Understanding AES-GCM IV (Nonce), Tag/MAC, Message & Transmission
I am working on a project that uses PAKE (SRP) for authentication. When we send the M1 to the server we are encrypting the payload using AES-GCM. I mention SRP only to set the context:
A message is ...
- 90.2k
1
vote
1
answer
244
views
What does AES-GCM provide?
I am wondering does AES-GCM which uses Authenticated Encryption provide us with all 3 properties (Authenticity, Confidentiality, and Integrity), or does it not provide integrity?
- 46k
1
vote
1
answer
927
views
How long does it take to decrypt AES encrypted message with salt(for pbkdf2 key) and iv known
I'm new to crypto!
The situation is,
Aes-256-cbc encrypted message(including not encrypted iv & salt) is revealed.
We also know pbkdf2 function uses 10000 rounds with sha256.
All we need to ...
- 134k
1
vote
0
answers
57
views
Should I encrypt individual columns or all data?
I want to AES-GCM some user data that I‘m going to persist in a database. I‘m wondering if I should encrypt individual columns (all with an individual IV ofc) or JSON stringify the sensitive data and ...
- 111
0
votes
0
answers
82
views
How can I show that AES-GCM is secure under the adaptive chosen cipher-text game?
How can I show that AES-GCM is secure under the adaptive chosen ciphertext game?
This is assuming the GHASH Mac tag can't be forged faster than brute force?
- 151
1
vote
1
answer
326
views
How are long IVs used in AES-GCM?
I looked through NIST's official test vectors (CAVP) for the AES-GCM mode, and noticed that there are some test vectors in there with 8-bit or 1024-bit IVs. But as far as I understand, the GCM ...
- 167
0
votes
0
answers
269
views
Decryption failure for NIST vector AES-CBC-128
I am learning/exploring the openssl library for encrypting and decrypting data
while encryption goes through fine I see standalone decryption not working as I expected.
The test vector I am using is
<...
- 1
0
votes
1
answer
272
views
What is the use of Additional data or associated data in AESGcm. How it is used while encryption and decryption [closed]
I am trying to understand the AESGcm encryption and decryption and there's one field associated data in Encryption and Decryption methods.
https://learn.microsoft.com/en-us/dotnet/api/system.security....
- 140k
2
votes
2
answers
3k
views
Inverse MixColumns Operation of AES
I am aware that MixColumns is a mixing operation which operates on the columns of the state, combining the four bytes in each column. So we multiply our state with ...
1
vote
0
answers
76
views
Using a signature as key material
I am designing my first web3 app and I would like to use MetaMask as an identity and crypto provider. My web3 app will encrypt user data with AES-GCM, but I do not want to generate and store an ...
- 11
1
vote
1
answer
81
views
Is MAC unnecessary for client side encryption?
In my open source with offline client side encryption application, I plan to use AES-CTR or ChaCha20 without MAC instead of GCM or Poly1305 since:
There is no database, the ciphertext, nonce, tag ...
- 2,741
0
votes
2
answers
558
views
How is AES256-GCM auth tag used in decryption
I have been playing with AES256-GCM in NodeJS crypto library and it shows that the original message can be decrypted without caring about the auth tag.
So can a non-tag verified decryption be secure? ...
- 90.2k
0
votes
1
answer
740
views
How is AES-GCM IV and auth tag used?
I have been learning about AES-GCM and AES in general lately and founding:
The key is the secret and both sender and receiver keep it hidden forever.
The IV and auth tag are public and sent along with ...
- 90.2k
1
vote
1
answer
474
views
Aes-Gcm how to perform decryption authentication without plaintext output in C#
I'm mainly trying to verify large file chunks which are encrypted each alone with a different key/salt/nonce for each chunk then appended to the whole file in the end to form 1 file.
One thing I ...
- 1,248
1
vote
1
answer
3k
views
How does AES GCM encryption work
Previously, I used AES CBC 256 with 256 bit key and 128 bit IV.
However it seems slow so I decide to switch to AES GCM 256 bit key, 96 bit IV which has some parts I don't understand such as:
Auth tag:...
- 134k
1
vote
2
answers
277
views
Argon2id creating key for cryptography, how acceptable is it to use the same salt for the same encryption operation?
Everyone knows Argon2id is a slow hashing algorithm, and that's on purpose, all is good.
When creating an Argon2id object a lot of parameters are needed to be taken into consideration ultimately ...
- 134k
1
vote
2
answers
523
views
Does the AES-GCM specification require the tag-size to be bound to the GCM context?
Does GCM spec (NIST SP 800-38D) require tag-size to be fixed for an instance of GCM algorithm (which usually fixes a specific GCM key)?
Asked differently, is the following a legitimate adherence to ...
- 1,248
0
votes
0
answers
69
views
Encrypt user AES keys with AWS KMS RSA key
I am developing a web application in which each user has some part of his data that is stored encrypted. We are hosted on AWS and I want to use KMS as part of the solution. To not make the solution ...
- 1
3
votes
1
answer
136
views
AES-GCM with different IVs but close enough for counter to cause duplicates
I am planning to use AES-GCM or AES-CTR for encryption. However, I have read from several sources that the IVs must be unique for every piece of information encrypted. I have a doubt though, what if I ...
- 90.2k
1
vote
1
answer
599
views
Using AES-256-GCM, is your security only 128 bits when solely relying on the MAC?
Since the maximum authentication tag (MAC) size of AES-256-GCM is 16 bytes,
And given that in one implementation, that breaking the MAC would break the security (ex. when a boolean 'decrypted' is used ...
- 134k
1
vote
1
answer
61
views
How does a GMAC in GCM not nullify the utility of a seekable decrypt-able stream
I have been looking at the Galois/Counter Mode (GCM) for stream encryption. I understand the idea that it's a stream cipher and so it can be encrypted one bit at a time by XORing with the key stream ...
- 90.2k
7
votes
2
answers
3k
views
Delayed tag checks in AES-GCM for streaming data
There is currently a GitHub discussion on .NET not supporting AES-GCM for any streaming data since releasing decrypted data prior to tag checks somehow reveals the plaintext or the AES key (or some ...
- 113
3
votes
1
answer
206
views
Key Committing AES-GCM
There is a handful of attacks against AEAD, and GCM in particular, which demonstrates that it is feasible for an attacker $\mathcal{A}$ to obtain a ciphertext $C$ which encrypts to multiple key/...
- 140k
2
votes
2
answers
625
views
For AES-GCM, does knowing plaintext and ciphertext allow attacker to learn the key?
Say, for an AES-GCM encryption, an attacker knows essentially everything except the key. This would include:
Plaintext
Ciphertext
IV
Algorithm (AES-GCM)
In this case, will the attacker gain any ...
- 14.9k
0
votes
1
answer
90
views
AES GCM mode - what is ouput in that scheme?
I'm trying to understand that scheme:
https://xilinx.github.io/Vitis_Libraries/security/2019.2/guide_L1/internals/gcm.html
Here on page 11 it looks like GHASH gives only one value "Return $Y_m$&...
- 1,181
1
vote
0
answers
395
views
How fast is GHASH and what does it do?
I read here:
https://www.researchgate.net/publication/220335697_GCM_GHASH_and_Weak_Keys
how GHASH works. So we have $m$ 128-bit blocks $X_{i}$ and we compute in $GF(2^{128})$:
$Y_{m} = \sum_{i=1}^{m} ...
- 20.1k
2
votes
1
answer
1k
views
Validating AES GCM authentication tag between two different implementations
I'm a bit confused on how to validate the authentication tag between two different AES GCM implementations.
One implementation (on my part) is in Java. The other, I don't know.
In my implementation, ...
- 23
1
vote
1
answer
1k
views
Is AES GCM with PBKDF2 100k iterations still ok as of 2022?
Is using AES GCM with PBKDF2 and 100 000 iterations still considered secure as of 2022?
In our threat model, if we ignore the risks linked to quantum computing, is this secure?
Here is an example ...
- 14.9k
4
votes
1
answer
296
views
Is a stream cipher and a (cryptographically secure) PRNG nearly the same thing?
If I let the authentification tag aside (which is important), encrypting with AES-GCM and a fixed key and nonce:
...
- 8,291
1
vote
1
answer
143
views
Clarification on nonce collision calculation
I've been working on a AES256-GCM implementation (in Java).
I'm a little bit stuck on the part where i need to decide how often i need to rotate my key.
I've got a lot of information from this posts:
...
- 20.2k
1
vote
1
answer
176
views
some questions about IPSEC ESN
ESN feature is described in RFC 4303. Here is some questions which bothered me:
When use ESN combined with AES_GCM or AES_GMAC alogrithom, do I need to add the high-order ESN bits to the packets?
...
CommunityBot
- 1