As of May 31, 2023, we have updated our Code of Conduct.

Questions tagged [aes-gcm]

Deprecated tag, see tag info. Advanced Encryption Standard Galois/Counter Mode, better known as AES-GCM is a mode of operation for symmetric key cryptographic block ciphers that has been widely adopted because of its efficiency and performance. GCM supports authenticated encryption, meaning that the mode not only offers privacy, but also integrity.

23 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
9 votes
0 answers
1k views

Key size, performance, and security tradeoffs for AES GCM / CCM

AES can be used with 128, 192 or 256 bit keys and each one appears to have a performance vs security trade-off (What is the effect of the different AES key lengths?, What are the practical differences ...
Raghu's user avatar
  • 255
9 votes
0 answers
233 views

GCM with reversed poly

These slides talk about how GCM can be sped up if one uses $x^{128}+x^{127}+x^{126}+x^{121}+1$ as the reduction polynomial instead of $x^{128}+x^7+x^2+x^1+1$. When one is doing that one needs to ...
neubert's user avatar
  • 2,855
3 votes
0 answers
86 views

How is the time intereval calculated for symmetric key re-negoatition in UK Security Standard – Use of Cryptography?

According to point 10.6.4 (Encryption in Transit) in Security Standard –Use of Cryptography, one of the criteria for key renegotiation is timeout , Encrypted sessions MUST re-negotiate new symmetric ...
hardyrama's user avatar
  • 1,990
3 votes
0 answers
1k views

WebCrypto AES-GCM vs AES-KW for key wrapping

The Web Crypto API available in most browsers supports both AES-GCM and AES-KW for key wrapping. There are examples for AES-KW and AES-GCM performing key wrapping, and a popular live table indicates ...
Brian M. Hunt's user avatar
3 votes
0 answers
316 views

Add authenticated encryption additional data (AEAD) to data encryption key (DEK)?

When using a DEK to encrypt data using envelope encryption do you need to add AEAD to the DEK itself? I would think that it is unnecessary because bit flipping attacks are useless against a DEK and ...
maletor's user avatar
  • 131
2 votes
0 answers
62 views

Safety of reusing same seed to derive secp256k1 keys and AES-256-GCM

The use case here is to deterministically generate a multi-use wallet from a single 12-word BIP39 mnemonic. Currently a standard process for deriving secp256k1 keypairs is implemented, e.g., using a ...
snsdgm's user avatar
  • 21
2 votes
0 answers
692 views

Why does CNG only (seem to) support FIPS-approved AES-GCM decryption but not encryption?

The Security Policy Document: Microsoft Windows FIPS 140 Validation (version 1.4 dated May 7, 2020) mentions in section 2.2: 2.2 FIPS 140-2 Approved Algorithms Cryptographic Primitives Library ...
Reinier Torenbeek's user avatar
1 vote
0 answers
34 views

AES-GCM for sensitive database field - good solution?

I have been researching the best encryption to use in a .NET application for managing a sensitive database field (column). This encryption is on top of e.g. AWS at-rest encryption applied to the whole ...
MFL's user avatar
  • 11
1 vote
0 answers
57 views

Should I encrypt individual columns or all data?

I want to AES-GCM some user data that I‘m going to persist in a database. I‘m wondering if I should encrypt individual columns (all with an individual IV ofc) or JSON stringify the sensitive data and ...
lenny.myr's user avatar
  • 111
1 vote
0 answers
76 views

Using a signature as key material

I am designing my first web3 app and I would like to use MetaMask as an identity and crypto provider. My web3 app will encrypt user data with AES-GCM, but I do not want to generate and store an ...
pinebitter's user avatar
1 vote
0 answers
389 views

How fast is GHASH and what does it do?

I read here: https://www.researchgate.net/publication/220335697_GCM_GHASH_and_Weak_Keys how GHASH works. So we have $m$ 128-bit blocks $X_{i}$ and we compute in $GF(2^{128})$: $Y_{m} = \sum_{i=1}^{m} ...
Tom's user avatar
  • 1,181
1 vote
1 answer
175 views

Multiple Encryption Using GCM For Multi-Key Security

Multiple Encryption For Multi-Key Security I have a hypothetical question about multiple encryption after reading Matthew Green’s blog on multiple encryption. For those who are familiar with GCM…I ...
JeffT's user avatar
  • 11
1 vote
0 answers
665 views

AES256-GCM Is it safe to both add the IV to the AAD and use it in the encryption?

I'm looking at a protocol which adds the IV (used for the encryption) into the AAD. If the IV (which is part of the message) was incorrect, decryption would fail anyway. Why is it useful to add the IV ...
fadedbee's user avatar
  • 771
1 vote
0 answers
38 views

Does my asymmetric/symmetric mixed file encryption pseudo code pass sanity check?

I realize this depends on my implementation and the implementation of the libraries I use. I am asking about my process assuming that the encryption libraries and my code are not flawed/compromised, ...
Stoopkid's user avatar
  • 123
1 vote
0 answers
227 views

Constructing an XChaCha20-Poly1305 Equivalent using FIPS-140 Primitives

I am playing around with the idea of modelling clustered data storage as a series of AEAD messages. XChaCha20-Poly1305 has nice properties for my intended design, as the ability to use random IVs ...
BlamKiwi's user avatar
  • 111
1 vote
0 answers
74 views

Usage of block and stream ciphers

I see that in many applications stream ciphers are common than block cipher - whether is Salsa20, AES-GCM, etc. In which cases would a stream cipher be preferred over a block cipher and vice versa? ...
Dror123's user avatar
  • 21
1 vote
0 answers
141 views

Store symmetrical (AES) key in Indexeddb?

Using web crypto API and it won't let me store an AES key in the indexeddb (it requires a public/private key). Does anyone have suggestions on how to do this? Should I/could I create a public/private ...
kaboom's user avatar
  • 11
1 vote
0 answers
377 views

AES-GCM - what are "Payload Length" and "AAD Length"

For the AES-GCM mode within many cryptomodules, their FIPS-validation certificates list the options: Payload Length: 504, 512, 1016, 1024 AAD Length: 0, 504, 512, 1016, 1024 For example in OpenSSL, "...
Kevin Sweere's user avatar
0 votes
0 answers
41 views

Question about Asymmetric key wrapping using (limited) AES-GCM

assuming that I have an RSA key of length 4k bit which I'm interested to wrap using AES-GCM, and I have a (limited) AES-GCM cipher which can only encrypt limited input in size (say 256-bit/512-bit ...
Rami's user avatar
  • 1
0 votes
0 answers
82 views

How can I show that AES-GCM is secure under the adaptive chosen cipher-text game?

How can I show that AES-GCM is secure under the adaptive chosen ciphertext game? This is assuming the GHASH Mac tag can't be forged faster than brute force?
CryptoGuru's user avatar
0 votes
0 answers
269 views

Decryption failure for NIST vector AES-CBC-128

I am learning/exploring the openssl library for encrypting and decrypting data while encryption goes through fine I see standalone decryption not working as I expected. The test vector I am using is <...
Eddy's user avatar
  • 1
0 votes
0 answers
69 views

Encrypt user AES keys with AWS KMS RSA key

I am developing a web application in which each user has some part of his data that is stored encrypted. We are hosted on AWS and I want to use KMS as part of the solution. To not make the solution ...
Adhocrat's user avatar
0 votes
0 answers
117 views

Proper implementation AES-256 for single block E_k then being used on AES-GCM

My first objective is to implement AES-GCM in PowerShell 5.1 since there is not an implementation that not use external dll libraries. According to the GCM schema of encryption: the E_k block should ...
Develobeer's user avatar