Questions tagged [aes-gcm]
Deprecated tag, see tag info. Advanced Encryption Standard Galois/Counter Mode, better known as AES-GCM is a mode of operation for symmetric key cryptographic block ciphers that has been widely adopted because of its efficiency and performance. GCM supports authenticated encryption, meaning that the mode not only offers privacy, but also integrity.
203
questions
39
votes
3
answers
10k
views
Why was AES CBC removed in TLS 1.3?
I don't quite understand why AES CBC was removed in TLS1.3.
From what I know CBC is the most secure Mode of operation for the AES block cipher (if you can say it like that).
It only needs a TRND IV ...
- 4,415
13
votes
1
answer
6k
views
What are the rules for using AES-GCM correctly?
When using AES-GCM I know that I am supposed to use a new initialization vector every time I call the AES-GCM algorithm with the same key. What are other rules must be followed to use AES-GCM ...
- 611
11
votes
2
answers
7k
views
Can AES-GCM be broken if initialisation vector is known?
We are using AES encryption in GCM block mode in order to encrypt a number of different kinds of data at rest on a mobile device - Android.
The key used for encryption is stored in the protected key-...
- 253
10
votes
1
answer
622
views
how does BearSSL's GCM modular reduction work?
BearSSL (in src/hash/ghash_ctmul.c) seems to be doing a modular reduction that I don't completely understand. Here's the code:
...
- 2,895
9
votes
3
answers
3k
views
Can a zero nonce be safely used with AES-GCM if the key is random and never used again?
I could generate a random nonce and prepend it to the ciphertext, but storage space is at a premium and the only constraint AES-GCM has on the nonce (if I'm reading correctly) is that the same nonce ...
- 582
9
votes
2
answers
2k
views
IV in Galois Counter Mode
I am looking at Wikepedia Galois Counter Mode article. I see this diagram
I am trying to figure out where the IV works its way in. Is it used to initialize the counter? If so, how does a sequence of ...
- 93
9
votes
1
answer
5k
views
TLS 1.2 Cipher Suites With AES-GCM – What data (if any) is passed to the AES-GCM cipher as the Additional Authentication Data?
TLS 1.2 defines a number of cipher suites that employ AES-GCM, e.g.:
...
- 193
9
votes
0
answers
1k
views
Key size, performance, and security tradeoffs for AES GCM / CCM
AES can be used with 128, 192 or 256 bit keys and each one appears to have a performance vs security trade-off (What is the effect of the different AES key lengths?, What are the practical differences ...
- 255
9
votes
0
answers
247
views
GCM with reversed poly
These slides talk about how GCM can be sped up if one uses $x^{128}+x^{127}+x^{126}+x^{121}+1$ as the reduction polynomial instead of $x^{128}+x^7+x^2+x^1+1$.
When one is doing that one needs to ...
- 2,895
8
votes
3
answers
22k
views
How to encrypt files using AES256-GCM cipher under Linux? [closed]
I'm struggling to implement AES256-GCM on a Linux machine to encrypt files outgoing to another party.
We're usually exchanging files using PKI, but this particular party insists on AES256-GCM and ...
- 123
8
votes
2
answers
3k
views
What are the popular modes-of-operation (AES-GCM, AES-SIV, AES-GCM-SIV, etc.) geared for?
I'm interested in developing software capable of encrypting personal files (which will ultimately be backed up to the cloud) and have been doing my best to follow best practices.
There are many forms ...
- 181
8
votes
1
answer
3k
views
Deterministic Encryption with AES GCM - how to choose the IV (nonce)
I have not a very large background in cryptography so I hope these questions are not very dumb. I don't want to reinvent the wheel, I'm just looking for advise on the best practices about how to build ...
- 183
7
votes
2
answers
3k
views
Delayed tag checks in AES-GCM for streaming data
There is currently a GitHub discussion on .NET not supporting AES-GCM for any streaming data since releasing decrypted data prior to tag checks somehow reveals the plaintext or the AES key (or some ...
- 1,697
7
votes
1
answer
2k
views
What is Associated Data in AEAD?
I am trying to understand what is AEAD exactly. I am application developer not a cryptographer. I have been searching online for a while watched a bunch of Youtube videos, read through a couple of ...
- 611
6
votes
1
answer
16k
views
Why GCM operation mode with AES-128 is recomended and can we use AES-192 and AES-256 with GCM?
It happens that on the internet I often find that AES encryption should use a 128-bit key only if it is used in conjunction with the GCM mode of operation.
Why only with 128-bit keys?
What happens ...
user75600
6
votes
1
answer
562
views
Why doesn't GMAC/GCM encrypt its authentication tag?
As most know, a duplicate nonce with GMAC/GCM allows key recovery attacks against GMAC itself and thus the ability to forge messages. This is because GMAC computes GHASH and then just XORs this with ...
- 896
6
votes
1
answer
13k
views
Apple secure notes. How secure?
In terms of cryptography, how secure is Apple Secure Notes? Can one store sensitive information there? The relevant section of the Apple white paper is quoted below:
The Notes app includes a Secure ...
- 161
6
votes
1
answer
180
views
Is this a typo/error in the Galois/Counter mode specification or have I misunderstood?
I've been reading the following document describing Galois Counter Mode:
The Galois/Counter Mode of Operation
On page 7 of the document, the following diagram describes the ...
- 562
5
votes
2
answers
2k
views
What are the actual merits of Galois/Counter Mode?
GCM (Galois/Counter Mode), in particular in combination with AES, has been a de-facto gold standard for years. Encrypt and authenticate in one step, that's just too awesome, and terms like AEAD work ...
- 918
5
votes
2
answers
2k
views
How is NIST's Key Wrap (using AES GCM) different than normal AES GCM Authenticated encryption?
From what I could gather, it seems like that NIST's key wrap (publication) provides similar security like AES-GCM Authenticated encryption. If this is true, why did we need a separate specification ...
- 71
5
votes
1
answer
615
views
The Rationale behind NIST's counter/LFSR recommendation on deterministic IV constructions on SP 800-38D
The NIST has a "SP 800-38D: Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC". This guideline is a base for AES-GCM from definition to security ...
- 47.6k
4
votes
2
answers
2k
views
OpenSSL AES-GCM says 'bad decrypt', other block modes work fine?
If I do a simple encrypt and decrypt test like so:
...
- 1,397
4
votes
1
answer
330
views
Is a stream cipher and a (cryptographically secure) PRNG nearly the same thing?
If I let the authentification tag aside (which is important), encrypting with AES-GCM and a fixed key and nonce:
...
- 543
4
votes
2
answers
923
views
Is it possible to recover AES-GCM plaintext when having everything but the additional data?
I'm using the window.crypto library in browsers.
I use iv from window.crypto.getRandomValues...
- 143
4
votes
1
answer
3k
views
Real time video stream AES encryption with authentication
I am now studying AES encryption for real-time video streaming. It seems that Netflix uses the AES-GCM (or CBC + MAC) mode for real-time video encryption and authentication. With MAC authentication, ...
- 41
4
votes
3
answers
4k
views
AES-GCM conformance test
Is there any conformance tests/sequences to validate AES-GCM & GHASH() implementation?
Details: I'm implementing AES-GSM, that's just for better understanding of that stuff, nothing more. Well I ...
- 205
4
votes
1
answer
3k
views
Proper way of encrypting large files with AES-256-GCM
I would like to encrypt and decrypt files with AES-256-GCM. I need a solution that works with Java, PHP and JavaScript. In practice, users can upload, download files via web browser and/or desktop app ...
- 141
4
votes
1
answer
483
views
Is GCM with zero-length AAD less secure?
In a previous question, it was made clear that in the case of GCM, there is no distinction between "no AAD" and "zero-length AAD". Since I have noticed "zero-length AAD" ...
- 191
4
votes
0
answers
81
views
Masking countermeasures for AES-GCM
Suppose I have a masked AES encryption $AES(\oplus_i K_i, \oplus_i P_i)=\oplus_i C_i$, i.e. the key, plaintext, and resulting ciphertext are tuples $K_i$, $P_i$, and $C_i$ that sum to $K$, $P$, and $C$...
- 367
4
votes
0
answers
157
views
Patent Status & Usability of AE Modes [closed]
Post Structure:
Sources Cited
Question & Details
Before You Answer
Useful Info From Comments
Sources Cited:
https://blog.cryptographyengineering.com/2012/05/19/how-to-choose-authenticated-...
3
votes
2
answers
689
views
Encrypting arbitrary large files in AEAD chunks - how to protect against chunk reordering?
I would like to encrypt big files using an authenticated cipher. I am convinced to use approach where file is divided into smaller manageable chunks that fit easily in memory (e.g. 1-10MB size) which ...
- 133
3
votes
1
answer
396
views
What if an AES GCM nonce overflows and collides with the GHASH nonce (0^128)?
When using AES in GCM mode, the GHASH function uses E(0^128) as the initial value for H, the authentication key. The IV, for the underlaying CTR mode, is initialized with:
[prefix (application nonce)]...
- 279
3
votes
1
answer
3k
views
Is AES-GCM with static key and dynamic salt safe to reuse IV/nonce
Problem: want to encrypt messages/objects/files using AES-GCM with the same secret key in a safe way, but want to do it in distributed/stateless way, so the IV of previous encryptions with the same ...
- 33
3
votes
2
answers
899
views
For AES-GCM, does knowing plaintext and ciphertext allow attacker to learn the key?
Say, for an AES-GCM encryption, an attacker knows essentially everything except the key. This would include:
Plaintext
Ciphertext
IV
Algorithm (AES-GCM)
In this case, will the attacker gain any ...
- 133
3
votes
2
answers
355
views
Extending AES-GCM initialization vector
We all know that applications of crypto primitives like to not think about the management of nonces, and initialization vectors and often prefer to just set them to random values. This sometimes leads ...
- 1,175
3
votes
2
answers
1k
views
Size of IV in AES-GCM according to RFC 4106
RFC 4106 specifies about nonce. It contains a salt of size 4 octets and an iv of size 8 octets. Further, RFC specifies that salt is assigned at the beginning of the security associations which is ...
farooq
3
votes
1
answer
79
views
GCM-SIV vs CBC with fixed IV?
I keep hearing CBC with fixed IV mode is bad because it has similar issues to the codebook breakdown of ECB mode. However, people seem quite willing to recommend AES-GCM-SIV for deterministic ...
- 31
3
votes
2
answers
995
views
Plain text size limits for AES-GCM mode at 2GB with Sun JCE implementation?
The Sun JCE implementation of GCM is hard coded to refuse to encode more than 2 Gb, through the function GaloisCounterMode.checkDataLength() that returns an error message : "SunJCE provider only ...
- 245
3
votes
1
answer
2k
views
AES-GCM secure against IND-CCA2
How would you prove that AES-GCM is secure against a chosen ciphertext attack (IND-CCA2), assuming that the attacker cannot forge AES-GCM MAC tags in less than brute force?
- 33
3
votes
1
answer
2k
views
AES 128 GCM - dynamic key with static IV/nonce
I'm working on a project to upgrade an existing system that currently uses RC4 to encrypt a payload with a random session key. The session key is then encrypted with asymmetric public key encryption (...
3
votes
1
answer
106
views
What kind of hashing is GF multiplication in GCM cipher mode and GMAC?
In GCM, GMAC, the additional associated data (AAD) (as well as outputs of subsequent blocks) is multiplied by a polynomial H in GF(2^128). This appears to be doing some secure hashing.
Is that what's ...
- 97
3
votes
2
answers
1k
views
Using AES-GCM (or AEAD ciphers in general) as a pure MAC without encryption
What's the opinion on using an AEAD cipher such as AES-GCM for example as a pure message authentication code (MAC) when only message authentication but not encryption is required.
does it bring any ...
- 786
3
votes
1
answer
1k
views
Why can't AES-GCM be used in IKEv1 phase 1?
I was configuring a VPN on a firewall (fortigate) and realized that I could use AES-GCM for encryption in the IKEv1 phase 2 but not in the phase 1 and I was wondering why knowing that in IKEv2 we ...
- 165
3
votes
2
answers
2k
views
Is a single md5 hash a good way to generate an AES key?
This site says how to encrypt data using a password in go using AES-GCM.
It says the following:
When encrypting and decrypting data, it is important that you are using a 32 character, or 32 byte key. ...
- 31
3
votes
1
answer
2k
views
Key generation for AES-GCM-256 file encryption
I am currently working on a file encryption software that works via AES-GCM-256 and I am looking for feedback on the encryption key generation process I intend to implement.
So far, I have come up ...
- 71
3
votes
2
answers
556
views
AES - which cipher is the safest one out there and what are the best practices for creating and storing the key
I just started to learn cryptography. I've read a ton of articles but couldn't find a book or a course that is based on this subject (and also is not outdated).
Therefore I have a few questions (...
- 131
3
votes
1
answer
148
views
Does HMAC provide anything that AES GCM does not?
I would like to let the receiver has the ability to check the sender's authenticity when he gets the message.
Also, I want to protect the message's confidentiality and integrity.
Should I use ...
- 43
3
votes
1
answer
173
views
AES-GCM with different IVs but close enough for counter to cause duplicates
I am planning to use AES-GCM or AES-CTR for encryption. However, I have read from several sources that the IVs must be unique for every piece of information encrypted. I have a doubt though, what if I ...
- 33
3
votes
1
answer
323
views
Key Committing AES-GCM
There is a handful of attacks against AEAD, and GCM in particular, which demonstrates that it is feasible for an attacker $\mathcal{A}$ to obtain a ciphertext $C$ which encrypts to multiple key/...
3
votes
1
answer
339
views
Can the AES-GCM authentication tag be used as a key derivation function?
I want to build a deterministic key derivation tree, where the root is stored securely in a centralized service and the leaves are embedded in a multitude of devices. When a device wants to ...
- 562