Questions tagged [aes-gcm]
Deprecated tag, see tag info. Advanced Encryption Standard Galois/Counter Mode, better known as AES-GCM is a mode of operation for symmetric key cryptographic block ciphers that has been widely adopted because of its efficiency and performance. GCM supports authenticated encryption, meaning that the mode not only offers privacy, but also integrity.
187
questions
7
votes
3
answers
19k
views
How to encrypt files using AES256-GCM cipher under Linux? [closed]
I'm struggling to implement AES256-GCM on a Linux machine to encrypt files outgoing to another party.
We're usually exchanging files using PKI, but this particular party insists on AES256-GCM and ...
- 113
0
votes
2
answers
570
views
If all encrypt algorithms in TLS1.3 ciphersuites are AEAD , why do they keep including a Hash algorithm?
In TLS1.3 all allowed algorithms included in cipher suites are AEAD, which means they don't just encrypt but they authenticate too (thus if I don't misunderstand, they give not only confidentiality ...
- 103
0
votes
2
answers
572
views
Does HMAC provide anything that AEAD does not?
Alice and Bob have to talk through Eve. (server to device through untrusted third party that relays messages, no TLS available)
Assume a secure key. Out of scope. Example, ECDH key exchange with HKDF....
1
vote
2
answers
3k
views
AES 256 CBC - Storing local data, how to save IV vector?
I want to use AES256 CBC for protecting small data (<100kb) against misusage for my application in the local store folder. I'm not an expert at data encrypting so I'm to try to understand it step ...
0
votes
1
answer
81
views
Is encryption with the Web Cryptography API resistant against side channel attacks?
If I want to encrypt some payload with AES-GCM, with the Web Cryptography API, how resistant would this be against side channel attacks?
user73598
2
votes
1
answer
896
views
How can AES-CCM behave as an AEAD stream cipher?
AESCCM- Couter with Cipher Block Chaining Message.
As it uses cmac for generation for tag , which is internally aes-cbc (block cipher, need block size, may require padding) And Encryption is done ...
- 145
5
votes
2
answers
1k
views
What are the actual merits of Galois/Counter Mode?
GCM (Galois/Counter Mode), in particular in combination with AES, has been a de-facto gold standard for years. Encrypt and authenticate in one step, that's just too awesome, and terms like AEAD work ...
- 898
2
votes
1
answer
636
views
Key derivation for AES-GCM using HKDF?
I have a system comprising N >1000 nodes. At each node I would like to use HKDF to derive a unique 256-bit key, Kn (for the nth node), from a pre-shared master key, K0, and a locally-generated random ...
- 21
3
votes
1
answer
1k
views
Why can't AES-GCM be used in IKEv1 phase 1?
I was configuring a VPN on a firewall (fortigate) and realized that I could use AES-GCM for encryption in the IKEv1 phase 2 but not in the phase 1 and I was wondering why knowing that in IKEv2 we ...
- 165
0
votes
1
answer
403
views
Can I use a fixed IV with AES-GCM if I only encrypt unique plaintext values? [duplicate]
My use case guarantees that all plaintext values are unique. In this case, is it safe to use a fixed IV with AES-GCM to carry our encryption/decryption?
- 431
0
votes
1
answer
433
views
Is the AES-GCM encryption using the SHA256 hash of the plaintext as IV secure?
I want to encrypt a list of unique values and I want the property of when I encrypt the same value I get the same ciphertext (determinism). The adversary only observes the ciphertexts of a unique set ...
- 431
5
votes
1
answer
508
views
Why doesn't GMAC/GCM encrypt its authentication tag?
As most know, a duplicate nonce with GMAC/GCM allows key recovery attacks against GMAC itself and thus the ability to forge messages. This is because GMAC computes GHASH and then just XORs this with ...
- 876
3
votes
1
answer
354
views
What if an AES GCM nonce overflows and collides with the GHASH nonce (0^128)?
When using AES in GCM mode, the GHASH function uses E(0^128) as the initial value for H, the authentication key. The IV, for the underlaying CTR mode, is initialized with:
[prefix (application nonce)]...
- 279
1
vote
1
answer
110
views
Decrypt authenticated cipher while still encrypting [duplicate]
Normal AES-GCM generates an authentication tag at the end of encryption. I want to decrypt it while it is still being encrypted. This would be useful to send, encrypt, receive and decrypt a large file ...
- 11
0
votes
2
answers
549
views
Do I still need SHA256 if I already had a AES 256 key that is 44 characters long?
Several months ago, I was required to research AES and SHA-256 to make a secured license system for my app. However, I was dumb enough that couldn't distinguish between the 256 bits from AES and the ...
3
votes
2
answers
863
views
Plain text size limits for AES-GCM mode at 2GB with Sun JCE implementation?
The Sun JCE implementation of GCM is hard coded to refuse to encode more than 2 Gb, through the function GaloisCounterMode.checkDataLength() that returns an error message : "SunJCE provider only ...
- 245
1
vote
1
answer
364
views
Encrypting more than ~64GiB with AES-GCM - Integrity
I'm looking for solution to encrypt more than acceptable limit ~64GiB under same key with AES-GCM. I know I'm obligated to exchange nonces for each next ~64GiB chunk, but there is one thing that is ...
user66005
0
votes
1
answer
689
views
Apple CryptoKit - Understanding its portability
I've been playing with Apple's CryptoKit (their effort to make their old CommonCrypto lib more modern and easy to use via Swift, their programming language).
I'm interested to see how portable it is.....
- 1,344
1
vote
2
answers
788
views
How to implement correctly an Integrated Encryption Scheme?
I am developing a REST client (from an Android Point Of Sale) where I'm given a public RSA 2048-bit key and I need to encrypt transaction information. Since that single block cannot be encrypted (and ...
9
votes
3
answers
3k
views
Can a zero nonce be safely used with AES-GCM if the key is random and never used again?
I could generate a random nonce and prepend it to the ciphertext, but storage space is at a premium and the only constraint AES-GCM has on the nonce (if I'm reading correctly) is that the same nonce ...
- 582
2
votes
1
answer
154
views
I need help determining the best encryption options based on System.Security.Cryptography in .NET
I asked a question on Code Review Stack Exchange, and received a great summary but was redirected here. Covering the answers of the post, it was noted and suggested that:
Use of plain (CBC) mode. ...
- 123
1
vote
1
answer
322
views
Why does Carter-Wegman (and AES-GCM) use different keys for PRF and keyed-hash
So. As I understand, Carter-Wegman transforms a one-time MAC (which must be a difference unpredictable function (DUF)) by encrypting it with a PRF.
The DUF and the PRF use two different keys, which ...
- 1,515
0
votes
2
answers
791
views
What Are the Risks of AES-GCM [Key, Nonce, Message] where Nonce = Message
A group of bankers will store sensitive financial information on a server owned by a third party. I represent the 3rd party server.
The financial information will be stored as plain text on the ...
0
votes
2
answers
140
views
GCM optimisation using $M_0$ and $R$ tables - Calculation of $R$
I'm implementing GCM in C as a way to learn about it. In the paper titled as The Galois/Counter Mode of Operation (GCM) by McGrew and Viega on chapter 4.1, page 11, 12, they talk about the ...
9
votes
0
answers
1k
views
Key size, performance, and security tradeoffs for AES GCM / CCM
AES can be used with 128, 192 or 256 bit keys and each one appears to have a performance vs security trade-off (What is the effect of the different AES key lengths?, What are the practical differences ...
- 255
10
votes
1
answer
561
views
how does BearSSL's GCM modular reduction work?
BearSSL (in src/hash/ghash_ctmul.c) seems to be doing a modular reduction that I don't completely understand. Here's the code:
...
- 2,855
9
votes
0
answers
233
views
GCM with reversed poly
These slides talk about how GCM can be sped up if one uses $x^{128}+x^{127}+x^{126}+x^{121}+1$ as the reduction polynomial instead of $x^{128}+x^7+x^2+x^1+1$.
When one is doing that one needs to ...
- 2,855
1
vote
2
answers
1k
views
how does AES GCM in SSH work?
I was looking at RFC5647: AES Galois Counter Mode for the Secure Shell Transport Layer Protocol and had some questions about section 7.1 "IV and Counter Management". Here's that section:
<...
- 2,855
1
vote
1
answer
1k
views
1
vote
1
answer
4k
views
How to apply IV and tag to protect messages encrypted using AES-GCM?
I'm applying the Arduino Crypto Library for the code fragments.
In the above library, example of encryption and decryption using GCM given as follows:
For encryption:
...
- 13
1
vote
2
answers
362
views
Using a hash of data instead of the full raw data for authenticated data in AES-GCM
I am serialising JSON objects, and would like to encrypt some of the values. I plan to do this with AES-GCM.
I would also like to ensure the integrity of the overall object.
The requirements are ...
2
votes
1
answer
158
views
emulating AES GCM with AES CTR
Building off of Relationship between AES GCM and AES CTR... if your GCM nonce is "aaaa aaaa aaaa" (no spaces) then the CTR IV is that with (0,0,0,2) appending to it.
My question is... what happens ...
- 2,855
1
vote
2
answers
383
views
AES GCM mode and the message is the same as the password
In a case of using a password and get AES key using KDF to encrypt the same password (The password and the message is the same), How secure is that algorithm ?
- 55
5
votes
2
answers
2k
views
How is NIST's Key Wrap (using AES GCM) different than normal AES GCM Authenticated encryption?
From what I could gather, it seems like that NIST's key wrap (publication) provides similar security like AES-GCM Authenticated encryption. If this is true, why did we need a separate specification ...
- 71
3
votes
2
answers
2k
views
Is a single md5 hash a good way to generate an AES key?
This site says how to encrypt data using a password in go using AES-GCM.
It says the following:
When encrypting and decrypting data, it is important that you are using a 32 character, or 32 byte key. ...
- 31
1
vote
1
answer
224
views
Does re-transmission really reduce security?
I am using AES with GCM and a colleague told me "Repeating a VCC with the same key and a different message reduces the security of the key." He did not have any additional detail to offer.
What he ...
- 165
1
vote
1
answer
346
views
lookup encrypted text by clear text without decryption
I've implemented vouchers module in my web project where I use it to generate redeem get etc... vouchers.
since voucher codes are considered sensitive, I've considered to encrypt them using AES-GCM.
...
- 113
3
votes
1
answer
1k
views
AES-GCM secure against IND-CCA2
How would you prove that AES-GCM is secure against a chosen ciphertext attack (IND-CCA2), assuming that the attacker cannot forge AES-GCM MAC tags in less than brute force?
- 33
-1
votes
1
answer
1k
views
Differences between Webcrypto (js) and Cryptodome.Cipher.AES (python) [closed]
I'm trying to understand the difference in output of AES decrypt (GCM mode) using Webcrypto and Cryptodome.Cipher.AES in python.
...
- 109
1
vote
2
answers
275
views
Mixing block cipher modes (AES)
I'm trying to evaluate some changes to an existing codebase and one question that has come up is the block cipher mode. For legacy reasons we've been using AES in CBC mode, however it's unclear why ...
- 13
4
votes
0
answers
146
views
Patent Status & Usability of AE Modes [closed]
Post Structure:
Sources Cited
Question & Details
Before You Answer
Useful Info From Comments
Sources Cited:
https://blog.cryptographyengineering.com/2012/05/19/how-to-choose-authenticated-...
3
votes
0
answers
1k
views
WebCrypto AES-GCM vs AES-KW for key wrapping
The Web Crypto API available in most browsers supports both AES-GCM and AES-KW for key wrapping.
There are examples for AES-KW and AES-GCM performing key wrapping, and a popular live table indicates ...
- 289
2
votes
2
answers
3k
views
Inverse MixColumns Operation of AES
I am aware that MixColumns is a mixing operation which operates on the columns of the state, combining the four bytes in each column. So we multiply our state with ...
- 135
2
votes
1
answer
3k
views
Encryption / Decryption using AES-256 GCM
I am new in cryptography and I am facing some complications in encryption-decryption. I am trying to use AES-GCM with a 256-bit AES key and a 96-bit nonce. I use an open source project (Vault) to ...
- 23
3
votes
1
answer
2k
views
Key generation for AES-GCM-256 file encryption
I am currently working on a file encryption software that works via AES-GCM-256 and I am looking for feedback on the encryption key generation process I intend to implement.
So far, I have come up ...
- 71
3
votes
2
answers
549
views
AES - which cipher is the safest one out there and what are the best practices for creating and storing the key
I just started to learn cryptography. I've read a ton of articles but couldn't find a book or a course that is based on this subject (and also is not outdated).
Therefore I have a few questions (...
- 131
2
votes
1
answer
309
views
Is using derived keys for HKDF + AES-GCM safe
I have an existing system which takes a cryptographically secure BLOB from user and pass it to lower API which calls HKDF-Expand to get 2 keys: one is effectively discarded in this scenario and second ...
- 121
2
votes
1
answer
122
views
What would be an adversary advantage in case of GCM authentication?
Philip Rogaway has written a formula for CCM mode where the adversary advantage is given as:
$$adversary\_advantage \leq \frac{q_{dec}}{2^t} + \frac{\sigma^2}{2^b}$$
Can we use this formula to find ...
- 37
1
vote
1
answer
2k
views
AES-GCM GHASH calculation;
I'm trying to make an GHASH() function and need some clarification.
Implementation is based on gcm-spec. Page 8 describes polynomial mult and page 27 has a "Test Case 2" which I use to verify result.
...
- 195
4
votes
1
answer
3k
views
Real time video stream AES encryption with authentication
I am now studying AES encryption for real-time video streaming. It seems that Netflix uses the AES-GCM (or CBC + MAC) mode for real-time video encryption and authentication. With MAC authentication, ...
- 41