# Questions tagged [aes-gcm]

Deprecated tag, see tag info. Advanced Encryption Standard Galois/Counter Mode, better known as AES-GCM is a mode of operation for symmetric key cryptographic block ciphers that has been widely adopted because of its efficiency and performance. GCM supports authenticated encryption, meaning that the mode not only offers privacy, but also integrity.

24 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
1k views

### Key size, performance, and security tradeoffs for AES GCM / CCM

AES can be used with 128, 192 or 256 bit keys and each one appears to have a performance vs security trade-off (What is the effect of the different AES key lengths?, What are the practical differences ...
• 255
247 views

### GCM with reversed poly

These slides talk about how GCM can be sped up if one uses $x^{128}+x^{127}+x^{126}+x^{121}+1$ as the reduction polynomial instead of $x^{128}+x^7+x^2+x^1+1$. When one is doing that one needs to ...
• 2,895
86 views

Suppose I have a masked AES encryption $AES(\oplus_i K_i, \oplus_i P_i)=\oplus_i C_i$, i.e. the key, plaintext, and resulting ciphertext are tuples $K_i$, $P_i$, and $C_i$ that sum to $K$, $P$, and $C$...
• 367
95 views

### How is the time intereval calculated for symmetric key re-negoatition in UK Security Standard – Use of Cryptography?

According to point 10.6.4 (Encryption in Transit) in Security Standard –Use of Cryptography, one of the criteria for key renegotiation is timeout , Encrypted sessions MUST re-negotiate new symmetric ...
• 2,074
1k views

### WebCrypto AES-GCM vs AES-KW for key wrapping

The Web Crypto API available in most browsers supports both AES-GCM and AES-KW for key wrapping. There are examples for AES-KW and AES-GCM performing key wrapping, and a popular live table indicates ...
326 views

When using a DEK to encrypt data using envelope encryption do you need to add AEAD to the DEK itself? I would think that it is unnecessary because bit flipping attacks are useless against a DEK and ...
• 131
85 views

### Safety of reusing same seed to derive secp256k1 keys and AES-256-GCM

The use case here is to deterministically generate a multi-use wallet from a single 12-word BIP39 mnemonic. Currently a standard process for deriving secp256k1 keypairs is implemented, e.g., using a ...
• 21
861 views

### Why does CNG only (seem to) support FIPS-approved AES-GCM decryption but not encryption?

The Security Policy Document: Microsoft Windows FIPS 140 Validation (version 1.4 dated May 7, 2020) mentions in section 2.2: 2.2 FIPS 140-2 Approved Algorithms Cryptographic Primitives Library ...
1 vote
76 views

### AES-GCM for sensitive database field - good solution?

I have been researching the best encryption to use in a .NET application for managing a sensitive database field (column). This encryption is on top of e.g. AWS at-rest encryption applied to the whole ...
• 11
1 vote
59 views

### Should I encrypt individual columns or all data?

I want to AES-GCM some user data that I‘m going to persist in a database. I‘m wondering if I should encrypt individual columns (all with an individual IV ofc) or JSON stringify the sensitive data and ...
• 111
1 vote
90 views

### Using a signature as key material

I am designing my first web3 app and I would like to use MetaMask as an identity and crypto provider. My web3 app will encrypt user data with AES-GCM, but I do not want to generate and store an ...
1 vote
545 views

### How fast is GHASH and what does it do?

I read here: https://www.researchgate.net/publication/220335697_GCM_GHASH_and_Weak_Keys how GHASH works. So we have $m$ 128-bit blocks $X_{i}$ and we compute in $GF(2^{128})$: \$Y_{m} = \sum_{i=1}^{m} ...
• 1,211
1 vote
234 views

### Multiple Encryption Using GCM For Multi-Key Security

Multiple Encryption For Multi-Key Security I have a hypothetical question about multiple encryption after reading Matthew Green’s blog on multiple encryption. For those who are familiar with GCM…I ...
• 11
1 vote
748 views

### AES256-GCM Is it safe to both add the IV to the AAD and use it in the encryption?

I'm looking at a protocol which adds the IV (used for the encryption) into the AAD. If the IV (which is part of the message) was incorrect, decryption would fail anyway. Why is it useful to add the IV ...
• 897
1 vote
38 views

### Does my asymmetric/symmetric mixed file encryption pseudo code pass sanity check?

I realize this depends on my implementation and the implementation of the libraries I use. I am asking about my process assuming that the encryption libraries and my code are not flawed/compromised, ...
• 123
1 vote
250 views

### Constructing an XChaCha20-Poly1305 Equivalent using FIPS-140 Primitives

I am playing around with the idea of modelling clustered data storage as a series of AEAD messages. XChaCha20-Poly1305 has nice properties for my intended design, as the ability to use random IVs ...
• 111
1 vote
76 views

### Usage of block and stream ciphers

I see that in many applications stream ciphers are common than block cipher - whether is Salsa20, AES-GCM, etc. In which cases would a stream cipher be preferred over a block cipher and vice versa? ...
• 21
1 vote
151 views

### Store symmetrical (AES) key in Indexeddb?

Using web crypto API and it won't let me store an AES key in the indexeddb (it requires a public/private key). Does anyone have suggestions on how to do this? Should I/could I create a public/private ...
• 11
1 vote
443 views

For the AES-GCM mode within many cryptomodules, their FIPS-validation certificates list the options: Payload Length: 504, 512, 1016, 1024 AAD Length: 0, 504, 512, 1016, 1024 For example in OpenSSL, "...
83 views

### Is it possible to uncover the plaintext if IV is used twice but the key is different?

I am currently working on a cryptography challenge. The program uses AES-GCM to encrypt and decrypt strings. Let's say I have the following: IV which is reused only 1 cipher text authentication tag ...
• 101
48 views

### Question about Asymmetric key wrapping using (limited) AES-GCM

assuming that I have an RSA key of length 4k bit which I'm interested to wrap using AES-GCM, and I have a (limited) AES-GCM cipher which can only encrypt limited input in size (say 256-bit/512-bit ...
• 1
287 views

### Decryption failure for NIST vector AES-CBC-128

I am learning/exploring the openssl library for encrypting and decrypting data while encryption goes through fine I see standalone decryption not working as I expected. The test vector I am using is <...
• 1