Questions tagged [aes-gcm]

Deprecated tag, see tag info. Advanced Encryption Standard Galois/Counter Mode, better known as AES-GCM is a mode of operation for symmetric key cryptographic block ciphers that has been widely adopted because of its efficiency and performance. GCM supports authenticated encryption, meaning that the mode not only offers privacy, but also integrity.

12 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
8
votes
0answers
685 views

Key size, performance, and security tradeoffs for AES GCM / CCM

AES can be used with 128, 192 or 256 bit keys and each one appears to have a performance vs security trade-off (What is the effect of the different AES key lengths?, What are the practical differences ...
8
votes
0answers
175 views

GCM with reversed poly

These slides talk about how GCM can be sped up if one uses $x^{128}+x^{127}+x^{126}+x^{121}+1$ as the reduction polynomial instead of $x^{128}+x^7+x^2+x^1+1$. When one is doing that one needs to ...
3
votes
0answers
49 views

How is the time intereval calculated for symmetric key re-negoatition in UK Security Standard – Use of Cryptography?

According to point 10.6.4 (Encryption in Transit) in Security Standard –Use of Cryptography, one of the criteria for key renegotiation is timeout , Encrypted sessions MUST re-negotiate new symmetric ...
3
votes
0answers
596 views

WebCrypto AES-GCM vs AES-KW for key wrapping

The Web Crypto API available in most browsers supports both AES-GCM and AES-KW for key wrapping. There are examples for AES-KW and AES-GCM performing key wrapping, and a popular live table indicates ...
3
votes
0answers
243 views

Add authenticated encryption additional data (AEAD) to data encryption key (DEK)?

When using a DEK to encrypt data using envelope encryption do you need to add AEAD to the DEK itself? I would think that it is unnecessary because bit flipping attacks are useless against a DEK and ...
2
votes
0answers
107 views

Why does CNG only (seem to) support FIPS-approved AES-GCM decryption but not encryption?

The Security Policy Document: Microsoft Windows FIPS 140 Validation (version 1.4 dated May 7, 2020) mentions in section 2.2: 2.2 FIPS 140-2 Approved Algorithms Cryptographic Primitives Library ...
1
vote
0answers
47 views

Usage of block and stream ciphers

I see that in many applications stream ciphers are common than block cipher - whether is Salsa20, AES-GCM, etc. In which cases would a stream cipher be preferred over a block cipher and vice versa? ...
1
vote
0answers
74 views

Store symmetrical (AES) key in Indexeddb?

Using web crypto API and it won't let me store an AES key in the indexeddb (it requires a public/private key). Does anyone have suggestions on how to do this? Should I/could I create a public/private ...
1
vote
0answers
146 views

AES-GCM - what are “Payload Length” and “AAD Length”

For the AES-GCM mode within many cryptomodules, their FIPS-validation certificates list the options: Payload Length: 504, 512, 1016, 1024 AAD Length: 0, 504, 512, 1016, 1024 For example in OpenSSL, "...
0
votes
0answers
18 views

Encrypting Sectors of MiFare Plus SE

I am trying to have some MiFare Plus SE cards manufactured but I was told that I need to give instructions on the HMAC encoding method, as shown in the image, which I understand and have done, but ...
0
votes
0answers
32 views

Are there popular and secure Authenticated Encryption schemes with Salsa20/Sosemanuk in CTR-mode with a Carter-Wegman MAC?

I read that AES/GCM is a good choice for authenticated encryption because: AES has very strong heuristic security Encrypt-then-MAC leaks no information about the plaintext The CW-MAC in GCM can be ...
0
votes
0answers
136 views

Requirements for AES-GCM Initialization Vector (IV)

AES-GCM requires a different Initialization Vector (IV) for every new stream of data that is encrypted using the same key. TLS generates the IV by XOR-ing a random static nonce (generated from the ...