Questions tagged [aes-gcm]
Deprecated tag, see tag info. Advanced Encryption Standard Galois/Counter Mode, better known as AES-GCM is a mode of operation for symmetric key cryptographic block ciphers that has been widely adopted because of its efficiency and performance. GCM supports authenticated encryption, meaning that the mode not only offers privacy, but also integrity.
24
questions with no upvoted or accepted answers
9
votes
0
answers
1k
views
Key size, performance, and security tradeoffs for AES GCM / CCM
AES can be used with 128, 192 or 256 bit keys and each one appears to have a performance vs security trade-off (What is the effect of the different AES key lengths?, What are the practical differences ...
- 255
9
votes
0
answers
247
views
GCM with reversed poly
These slides talk about how GCM can be sped up if one uses $x^{128}+x^{127}+x^{126}+x^{121}+1$ as the reduction polynomial instead of $x^{128}+x^7+x^2+x^1+1$.
When one is doing that one needs to ...
- 2,895
4
votes
0
answers
86
views
Masking countermeasures for AES-GCM
Suppose I have a masked AES encryption $AES(\oplus_i K_i, \oplus_i P_i)=\oplus_i C_i$, i.e. the key, plaintext, and resulting ciphertext are tuples $K_i$, $P_i$, and $C_i$ that sum to $K$, $P$, and $C$...
- 367
3
votes
0
answers
95
views
How is the time intereval calculated for symmetric key re-negoatition in UK Security Standard – Use of Cryptography?
According to point 10.6.4 (Encryption in Transit) in Security Standard –Use of Cryptography, one of the criteria for key renegotiation is timeout ,
Encrypted sessions MUST re-negotiate new symmetric ...
- 2,074
3
votes
0
answers
1k
views
WebCrypto AES-GCM vs AES-KW for key wrapping
The Web Crypto API available in most browsers supports both AES-GCM and AES-KW for key wrapping.
There are examples for AES-KW and AES-GCM performing key wrapping, and a popular live table indicates ...
- 289
3
votes
0
answers
326
views
Add authenticated encryption additional data (AEAD) to data encryption key (DEK)?
When using a DEK to encrypt data using envelope encryption do you need to add AEAD to the DEK itself? I would think that it is unnecessary because bit flipping attacks are useless against a DEK and ...
- 131
2
votes
0
answers
85
views
Safety of reusing same seed to derive secp256k1 keys and AES-256-GCM
The use case here is to deterministically generate a multi-use wallet from a single 12-word BIP39 mnemonic. Currently a standard process for deriving secp256k1 keypairs is implemented, e.g., using a ...
- 21
2
votes
0
answers
861
views
Why does CNG only (seem to) support FIPS-approved AES-GCM decryption but not encryption?
The Security Policy Document: Microsoft Windows FIPS 140 Validation (version 1.4
dated May 7, 2020) mentions in section 2.2:
2.2 FIPS 140-2 Approved Algorithms
Cryptographic Primitives Library ...
1
vote
0
answers
76
views
AES-GCM for sensitive database field - good solution?
I have been researching the best encryption to use in a .NET application for managing a sensitive database field (column). This encryption is on top of e.g. AWS at-rest encryption applied to the whole ...
- 11
1
vote
0
answers
59
views
Should I encrypt individual columns or all data?
I want to AES-GCM some user data that I‘m going to persist in a database. I‘m wondering if I should encrypt individual columns (all with an individual IV ofc) or JSON stringify the sensitive data and ...
- 111
1
vote
0
answers
90
views
Using a signature as key material
I am designing my first web3 app and I would like to use MetaMask as an identity and crypto provider. My web3 app will encrypt user data with AES-GCM, but I do not want to generate and store an ...
- 11
1
vote
0
answers
545
views
How fast is GHASH and what does it do?
I read here:
https://www.researchgate.net/publication/220335697_GCM_GHASH_and_Weak_Keys
how GHASH works. So we have $m$ 128-bit blocks $X_{i}$ and we compute in $GF(2^{128})$:
$Y_{m} = \sum_{i=1}^{m} ...
- 1,211
1
vote
1
answer
234
views
Multiple Encryption Using GCM For Multi-Key Security
Multiple Encryption For Multi-Key Security
I have a hypothetical question about multiple encryption after reading Matthew Green’s blog on multiple encryption. For those who are familiar with GCM…I ...
- 11
1
vote
0
answers
748
views
AES256-GCM Is it safe to both add the IV to the AAD and use it in the encryption?
I'm looking at a protocol which adds the IV (used for the encryption) into the AAD.
If the IV (which is part of the message) was incorrect, decryption would fail anyway.
Why is it useful to add the IV ...
- 897
1
vote
0
answers
38
views
Does my asymmetric/symmetric mixed file encryption pseudo code pass sanity check?
I realize this depends on my implementation and the implementation of the libraries I use. I am asking about my process assuming that the encryption libraries and my code are not flawed/compromised, ...
- 123
1
vote
0
answers
250
views
Constructing an XChaCha20-Poly1305 Equivalent using FIPS-140 Primitives
I am playing around with the idea of modelling clustered data storage as a series of AEAD messages. XChaCha20-Poly1305 has nice properties for my intended design, as the ability to use random IVs ...
- 111
1
vote
0
answers
76
views
Usage of block and stream ciphers
I see that in many applications stream ciphers are common than block cipher - whether is Salsa20, AES-GCM, etc. In which cases would a stream cipher be preferred over a block cipher and vice versa?
...
- 21
1
vote
0
answers
151
views
Store symmetrical (AES) key in Indexeddb?
Using web crypto API and it won't let me store an AES key in the indexeddb (it requires a public/private key).
Does anyone have suggestions on how to do this? Should I/could I create a public/private ...
- 11
1
vote
0
answers
443
views
AES-GCM - what are "Payload Length" and "AAD Length"
For the AES-GCM mode within many cryptomodules, their FIPS-validation certificates list the options:
Payload Length: 504, 512, 1016, 1024
AAD Length: 0, 504, 512, 1016, 1024
For example in OpenSSL, "...
- 11
0
votes
0
answers
83
views
Is it possible to uncover the plaintext if IV is used twice but the key is different?
I am currently working on a cryptography challenge. The program uses AES-GCM to encrypt and decrypt strings.
Let's say I have the following:
IV which is reused
only 1 cipher text
authentication tag
...
- 101
0
votes
0
answers
48
views
Question about Asymmetric key wrapping using (limited) AES-GCM
assuming that I have an RSA key of length 4k bit which I'm interested to wrap using AES-GCM, and I have a (limited) AES-GCM cipher which can only encrypt limited input in size (say 256-bit/512-bit ...
- 1
0
votes
0
answers
287
views
Decryption failure for NIST vector AES-CBC-128
I am learning/exploring the openssl library for encrypting and decrypting data
while encryption goes through fine I see standalone decryption not working as I expected.
The test vector I am using is
<...
- 1
0
votes
0
answers
87
views
Encrypt user AES keys with AWS KMS RSA key
I am developing a web application in which each user has some part of his data that is stored encrypted. We are hosted on AWS and I want to use KMS as part of the solution. To not make the solution ...
- 1
0
votes
0
answers
142
views
Proper implementation AES-256 for single block E_k then being used on AES-GCM
My first objective is to implement AES-GCM in PowerShell 5.1 since there is not an implementation that not use external dll libraries.
According to the GCM schema of encryption:
the E_k block should ...
- 101