Questions tagged [aes-gcm]

Deprecated tag, see tag info. Advanced Encryption Standard Galois/Counter Mode, better known as AES-GCM is a mode of operation for symmetric key cryptographic block ciphers that has been widely adopted because of its efficiency and performance. GCM supports authenticated encryption, meaning that the mode not only offers privacy, but also integrity.

Filter by
Sorted by
Tagged with
10
votes
1answer
316 views

how does BearSSL's GCM modular reduction work?

BearSSL (in src/hash/ghash_ctmul.c) seems to be doing a modular reduction that I don't completely understand. Here's the code: ...
9
votes
2answers
3k views

Can AES-GCM be broken if initialisation vector is known?

We are using AES encryption in GCM block mode in order to encrypt a number of different kinds of data at rest on a mobile device - Android. The key used for encryption is stored in the protected key-...
8
votes
3answers
1k views

Can a zero nonce be safely used with AES-GCM if the key is random and never used again?

I could generate a random nonce and prepend it to the ciphertext, but storage space is at a premium and the only constraint AES-GCM has on the nonce (if I'm reading correctly) is that the same nonce ...
8
votes
1answer
2k views

TLS 1.2 Cipher Suites With AES-GCM – What data (if any) is passed to the AES-GCM cipher as the Additional Authentication Data?

TLS 1.2 defines a number of cipher suites that employ AES-GCM, e.g.: ...
8
votes
1answer
1k views

Deterministic Encryption with AES GCM - how to choose the IV (nonce)

I have not a very large background in cryptography so I hope these questions are not very dumb. I don't want to reinvent the wheel, I'm just looking for advise on the best practices about how to build ...
8
votes
0answers
537 views

Key size, performance, and security tradeoffs for AES GCM / CCM

AES can be used with 128, 192 or 256 bit keys and each one appears to have a performance vs security trade-off (What is the effect of the different AES key lengths?, What are the practical differences ...
7
votes
2answers
859 views

IV in Galois Counter Mode

I am looking at Wikepedia Galois Counter Mode article. I see this diagram I am trying to figure out where the IV works its way in. Is it used to initialize the counter? If so, how does a sequence of ...
7
votes
0answers
156 views

GCM with reversed poly

These slides talk about how GCM can be sped up if one uses $x^{128}+x^{127}+x^{126}+x^{121}+1$ as the reduction polynomial instead of $x^{128}+x^7+x^2+x^1+1$. When one is doing that one needs to ...
6
votes
2answers
2k views

Delayed tag checks in AES-GCM for streaming data

There is currently a GitHub discussion on .NET not supporting AES-GCM for any streaming data since releasing decrypted data prior to tag checks somehow reveals the plaintext or the AES key (or some ...
6
votes
1answer
9k views

Apple secure notes. How secure?

In terms of cryptography, how secure is Apple Secure Notes? Can one store sensitive information there? The relevant section of the Apple white paper is quoted below: The Notes app includes a Secure ...
6
votes
1answer
137 views

Is this a typo/error in the Galois/Counter mode specification or have I misunderstood?

I've been reading the following document describing Galois Counter Mode: The Galois/Counter Mode of Operation On page 7 of the document, the following diagram describes the ...
4
votes
2answers
518 views

Is it possible to recover AES-GCM plaintext when having everything but the additional data?

I'm using the window.crypto library in browsers. I use iv from window.crypto.getRandomValues...
4
votes
1answer
249 views

Why doesn't GMAC/GCM encrypt its authentication tag?

As most know, a duplicate nonce with GMAC/GCM allows key recovery attacks against GMAC itself and thus the ability to forge messages. This is because GMAC computes GHASH and then just XORs this with ...
4
votes
0answers
116 views

Patent Status & Usability of AE Modes [closed]

Post Structure: Sources Cited Question & Details Before You Answer Useful Info From Comments Sources Cited: https://blog.cryptographyengineering.com/2012/05/19/how-to-choose-authenticated-...
3
votes
2answers
389 views

What are the actual merits of Galois/Counter Mode?

GCM (Galois/Counter Mode), in particular in combination with AES, has been a de-facto gold standard for years. Encrypt and authenticate in one step, that's just too awesome, and terms like AEAD work ...
3
votes
1answer
139 views

What if an AES GCM nonce overflows and collides with the GHASH nonce (0^128)?

When using AES in GCM mode, the GHASH function uses E(0^128) as the initial value for H, the authentication key. The IV, for the underlaying CTR mode, is initialized with: [prefix (application nonce)]...
3
votes
1answer
2k views

Is AES-GCM with static key and dynamic salt safe to reuse IV/nonce

Problem: want to encrypt messages/objects/files using AES-GCM with the same secret key in a safe way, but want to do it in distributed/stateless way, so the IV of previous encryptions with the same ...
3
votes
1answer
1k views

Real time video stream AES encryption with authentication

I am now studying AES encryption for real-time video streaming. It seems that Netflix uses the AES-GCM (or CBC + MAC) mode for real-time video encryption and authentication. With MAC authentication, ...
3
votes
1answer
1k views

AES 128 GCM - dynamic key with static IV/nonce

I'm working on a project to upgrade an existing system that currently uses RC4 to encrypt a payload with a random session key. The session key is then encrypted with asymmetric public key encryption (...
3
votes
2answers
560 views

Is a single md5 hash a good way to generate an AES key?

This site says how to encrypt data using a password in go using AES-GCM. It says the following: When encrypting and decrypting data, it is important that you are using a 32 character, or 32 byte ...
3
votes
1answer
469 views

AES - which cipher is the safest one out there and what are the best practices for creating and storing the key

I just started to learn cryptography. I've read a ton of articles but couldn't find a book or a course that is based on this subject (and also is not outdated). Therefore I have a few questions (...
3
votes
1answer
406 views

Why is counter mode encryption with a 16-byte cipher block not broken?

We determine a system IND-CPA secure when an adversary has a negligible advantage after any feasible amount of queries. AES256-GCM uses a 128bit block cipher. We know that the distinguishability ...
3
votes
0answers
227 views

Add authenticated encryption additional data (AEAD) to data encryption key (DEK)?

When using a DEK to encrypt data using envelope encryption do you need to add AEAD to the DEK itself? I would think that it is unnecessary because bit flipping attacks are useless against a DEK and ...
2
votes
3answers
413 views

Why this complexity defining AES-GCM counter block?

AES-GCM counter block is defined as nonce || IV || counter. Why this complexity? Knowing that it does not need to be secret and its only required property is to be ...
2
votes
1answer
184 views

Why is GCM not vulnerable at the birthday bound for 128 bit IV?

According to this article, which looks at attacks on Caesar candidates beyond what they claim, they include an attack on page 6 for nonce-respecting adversaries for AES-GCM which allows IVs longer ...
2
votes
3answers
2k views

How to encrypt files using AES256-GCM cipher under Linux? [closed]

I'm struggling to implement AES256-GCM on a Linux machine to encrypt files outgoing to another party. We're usually exchanging files using PKI, but this particular party insists on AES256-GCM and ...
2
votes
2answers
683 views

AES-GCM for Securing Bluetooth Low Energy Application

I have a task at hand on designing security on Bluetooth Low Energy application layer. The system is created so that only smartphones with symmetric key (long term) could communicate and control my ...
2
votes
1answer
454 views

AES-GCM secure against IND-CCA2

How would you prove that AES-GCM is secure against a chosen ciphertext attack (IND-CCA2), assuming that the attacker cannot forge AES-GCM MAC tags in less than brute force?
2
votes
2answers
511 views

Key wrapping - encrypting many times with AES-GCM

When encrypting many short plaintexts with a single key, lets say about 2^64 total plaintexts at under 64 bytes each: (edit note - was 2^70 in the original question) Is there a way to use AES-GCM, as ...
2
votes
2answers
84 views

Size of IV in AES-GCM according to RFC 4106

RFC 4106 specifies about nonce. It contains a salt of size 4 octets and an iv of size 8 octets. Further, RFC specifies that salt is assigned at the beginning of the security associations which is ...
2
votes
1answer
152 views

Key derivation for AES-GCM using HKDF?

I have a system comprising N >1000 nodes. At each node I would like to use HKDF to derive a unique 256-bit key, Kn (for the nth node), from a pre-shared master key, K0, and a locally-generated random ...
2
votes
1answer
168 views

Why can't AES-GCM be used in IKEv1 phase 1?

I was configuring a VPN on a firewall (fortigate) and realized that I could use AES-GCM for encryption in the IKEv1 phase 2 but not in the phase 1 and I was wondering why knowing that in IKEv2 we ...
2
votes
1answer
83 views

I need help determining the best encryption options based on System.Security.Cryptography in .NET

I asked a question here, and received a great summary but was redirected here. Covering the answers of the post, it was noted and suggested that: Use of plain (CBC) mode. They suggested to use GCM ...
2
votes
1answer
76 views

emulating AES GCM with AES CTR

Building off of Relationship between AES GCM and AES CTR... if your GCM nonce is "aaaa aaaa aaaa" (no spaces) then the CTR IV is that with (0,0,0,2) appending to it. My question is... what happens ...
2
votes
1answer
174 views

GCM mode of operation and IV size less 96 bits

GCM specification defines the initial counter value $Y_0$ for encryption/decryption operations as follows: $$ Y_0=\begin{cases} IV||0^{31}1 &\text{if len}(IV)=96\\ GHASH(H,\{\},IV)& \text{...
2
votes
1answer
158 views

Is using derived keys for HKDF + AES-GCM safe

I have an existing system which takes a cryptographically secure BLOB from user and pass it to lower API which calls HKDF-Expand to get 2 keys: one is effectively discarded in this scenario and second ...
2
votes
2answers
611 views

Is it safe to use a counter as IV for AES256-GCM

What if I will use 96-bit integer counter starting from 0 as IV for AES256-GCM cipher. Is it safe? Is there any other ways to ensure uniqueness of IV for GCM cipher?
2
votes
1answer
109 views

GCM and decrypting with Krack

I'm trying to understand how Krack works on GCM. I thought that looking at GCM would be easier since it's a full break and the video shows a tool that is able to decrypt everything. I see that the IV ...
2
votes
0answers
188 views

What are the popular modes-of-operation (AES-GCM, AES-SIV, AES-GCM-SIV, etc.) geared for?

I'm interested in developing software capable of encrypting personal files (which will ultimately be backed up to the cloud) and have been doing my best to follow best practices. There are many forms ...
2
votes
0answers
442 views

WebCrypto AES-GCM vs AES-KW for key wrapping

The Web Crypto API available in most browsers supports both AES-GCM and AES-KW for key wrapping. There are examples for AES-KW and AES-GCM performing key wrapping, and a popular live table indicates ...
2
votes
1answer
77 views

What would be an adversary advantage in case of GCM authentication?

Philip Rogaway has written a formula for CCM mode where the adversary advantage is given as: $$adversary\_advantage \leq \frac{q_{dec}}{2^t} + \frac{\sigma^2}{2^b}$$ Can we use this formula to find ...
1
vote
2answers
522 views

how does AES GCM in SSH work?

I was looking at RFC5647: AES Galois Counter Mode for the Secure Shell Transport Layer Protocol and had some questions about section 7.1 "IV and Counter Management". Here's that section: ...
1
vote
2answers
593 views

Deciding on an AES cipher mode for chunked data

I'm trying to decide on which ciphermode to use for a programming excercise. I have a file that I need to encrypt without saving unencrypted data to storage and without storing the entire file in ...
1
vote
1answer
81 views

Does re-transmission really reduce security?

I am using AES with GCM and a colleague told me "Repeating a VCC with the same key and a different message reduces the security of the key." He did not have any additional detail to offer. What he ...
1
vote
2answers
194 views

Why is the subhash key (H) of AES-GCM defined as such?

From what I've read in section 5.3 of NIST 800-38D it states: The hash subkey, denoted H, is generated by applying the block cipher to the “zero” block. In serious crypto J.P Aumasson describes ...
1
vote
1answer
214 views

AES-GCM: What can be done if 'H' is known by an attacker

What could an attacker do, if he had access to the value $H = AES(0)$ used for authentication in AES-GCM? Could the attacker do anything? Add some data in the authentication chain? Thanks
1
vote
1answer
128 views

Encrypting more than ~64GiB with AES-GCM - Integrity

I'm looking for solution to encrypt more than acceptable limit ~64GiB under same key with AES-GCM. I know I'm obligated to exchange nonces for each next ~64GiB chunk, but there is one thing that is ...
1
vote
1answer
2k views

How to apply IV and tag to protect messages encrypted using AES-GCM?

I'm applying the Arduino Crypto Library for the code fragments. In the above library, example of encryption and decryption using GCM given as follows: For encryption: ...
1
vote
2answers
138 views

Using a hash of data instead of the full raw data for authenticated data in AES-GCM

I am serialising JSON objects, and would like to encrypt some of the values. I plan to do this with AES-GCM. I would also like to ensure the integrity of the overall object. The requirements are ...
1
vote
1answer
128 views

It's safe to store a known value (for checking) next to the actually encrypted values

The high level details of the encryption I'm using is: AndroidKeyStore create/store RSA key AES key is created and wrapped with RSA/ECB/PKCS1Padding Encrypted AES is saved to disk. Data is encrypted ...