Questions tagged [aes-gcm]

Deprecated tag, see tag info. Advanced Encryption Standard Galois/Counter Mode, better known as AES-GCM is a mode of operation for symmetric key cryptographic block ciphers that has been widely adopted because of its efficiency and performance. GCM supports authenticated encryption, meaning that the mode not only offers privacy, but also integrity.

Filter by
Sorted by
Tagged with
2
votes
1answer
85 views

What would be an adversary advantage in case of GCM authentication?

Philip Rogaway has written a formula for CCM mode where the adversary advantage is given as: $$adversary\_advantage \leq \frac{q_{dec}}{2^t} + \frac{\sigma^2}{2^b}$$ Can we use this formula to find ...
1
vote
2answers
616 views

how does AES GCM in SSH work?

I was looking at RFC5647: AES Galois Counter Mode for the Secure Shell Transport Layer Protocol and had some questions about section 7.1 "IV and Counter Management". Here's that section: ...
1
vote
2answers
639 views

Deciding on an AES cipher mode for chunked data

I'm trying to decide on which ciphermode to use for a programming excercise. I have a file that I need to encrypt without saving unencrypted data to storage and without storing the entire file in ...
1
vote
1answer
98 views

Does re-transmission really reduce security?

I am using AES with GCM and a colleague told me "Repeating a VCC with the same key and a different message reduces the security of the key." He did not have any additional detail to offer. What he ...
1
vote
2answers
220 views

Why is the subhash key (H) of AES-GCM defined as such?

From what I've read in section 5.3 of NIST 800-38D it states: The hash subkey, denoted H, is generated by applying the block cipher to the “zero” block. In serious crypto J.P Aumasson describes ...
1
vote
1answer
235 views

AES-GCM: What can be done if 'H' is known by an attacker

What could an attacker do, if he had access to the value $H = AES(0)$ used for authentication in AES-GCM? Could the attacker do anything? Add some data in the authentication chain? Thanks
1
vote
1answer
158 views

Encrypting more than ~64GiB with AES-GCM - Integrity

I'm looking for solution to encrypt more than acceptable limit ~64GiB under same key with AES-GCM. I know I'm obligated to exchange nonces for each next ~64GiB chunk, but there is one thing that is ...
1
vote
2answers
402 views

How to implement correctly an Integrated Encryption Scheme?

I am developing a REST client (from an Android Point Of Sale) where I'm given a public RSA 2048-bit key and I need to encrypt transaction information. Since that single block cannot be encrypted (and ...
1
vote
1answer
2k views

How to apply IV and tag to protect messages encrypted using AES-GCM?

I'm applying the Arduino Crypto Library for the code fragments. In the above library, example of encryption and decryption using GCM given as follows: For encryption: ...
1
vote
2answers
157 views

Using a hash of data instead of the full raw data for authenticated data in AES-GCM

I am serialising JSON objects, and would like to encrypt some of the values. I plan to do this with AES-GCM. I would also like to ensure the integrity of the overall object. The requirements are ...
1
vote
1answer
134 views

It's safe to store a known value (for checking) next to the actually encrypted values

The high level details of the encryption I'm using is: AndroidKeyStore create/store RSA key AES key is created and wrapped with RSA/ECB/PKCS1Padding Encrypted AES is saved to disk. Data is encrypted ...
1
vote
1answer
1k views

AES-GCM Encryption and Replay Attacks

I have a doubt about AES-GCM on how can I avoid replay attacks. We have 2 users (Alice and Bob). After that the entities negotiate crypto parameters and generate a symmetric key, they'll exchange ...
1
vote
2answers
193 views

Can an AES-GCM be cracked if the key is known but the nonce isn't?

I'm kind of new in this field and I've been trying to learn it. I'm now facing an issue where I have a couple of packages encrypted with AES-128 GCM and I have the key that was used to encrypt these ...
1
vote
2answers
363 views

AES 256 CBC - Storing local data, how to save IV vector?

I want to use AES256 CBC for protecting small data (<100kb) against misusage for my application in the local store folder. I'm not an expert at data encrypting so I'm to try to understand it step ...
1
vote
2answers
248 views

Plain text size limits for AES-GCM mode at 2GB with Sun JCE implementation?

The Sun JCE implementation of GCM is hard coded to refuse to encode more than 2 Gb, through the function GaloisCounterMode.checkDataLength() that returns an error message : "SunJCE provider only ...
1
vote
2answers
86 views

Is the key safe if attacker know the encrypted and decrypted message?

Given an attacker know both the encrypted message (+ an iv) and the equivalent decrypted message, is it possible for him to craft a new encrypted message that could result in a desired decrypted ...
1
vote
1answer
209 views

What does GHASH really do?

I try to understand the GCM-MODE used in TLS. The problem I have had is described below. 1:textbook describes how GHASH works: 2: I get some debuginfo from openssl code that contain enc_key(32 bytes)...
1
vote
1answer
51 views

What is Associated Data in AEAD?

I am trying to understand what is AEAD exactly. I am application developer not a cryptographer. I have been searching online for a while watched a bunch of Youtube videos, read through a couple of ...
1
vote
1answer
75 views

Nonce of AES-GCM generated by Counters

i am trying to generate the nonce for AES-GCM. I know people usually generate it by Counters and LFSRs. I am confused about the meaning of Counters. Is that means Counter (CTR)? Why it can generate ...
1
vote
1answer
300 views

How can AES-CCM behave as an AEAD stream cipher?

AESCCM- Couter with Cipher Block Chaining Message. As it uses cmac for generation for tag , which is internally aes-cbc (block cipher, need block size, may require padding) And Encryption is done ...
1
vote
1answer
147 views

Why does Carter-Wegman (and AES-GCM) use different keys for PRF and keyed-hash

So. As I understand, Carter-Wegman transforms a one-time MAC (which must be a difference unpredictable function (DUF)) by encrypting it with a PRF. The DUF and the PRF use two different keys, which ...
1
vote
2answers
236 views

AES GCM mode and the message is the same as the password

In a case of using a password and get AES key using KDF to encrypt the same password (The password and the message is the same), How secure is that algorithm ?
1
vote
2answers
95 views

Mixing block cipher modes (AES)

I'm trying to evaluate some changes to an existing codebase and one question that has come up is the block cipher mode. For legacy reasons we've been using AES in CBC mode, however it's unclear why ...
1
vote
1answer
3k views

Encryption / Decryption using AES-256 GCM

I am new in cryptography and I am facing some complications in encryption-decryption. I am trying to use AES-GCM with a 256-bit AES key and a 96-bit nonce. I use an open source project (Vault) to ...
1
vote
1answer
716 views

Key generation for AES-GCM-256 file encryption

I am currently working on a file encryption software that works via AES-GCM-256 and I am looking for feedback on the encryption key generation process I intend to implement. So far, I have come up ...
1
vote
2answers
2k views

AES-GCM conformance test

Is there any conformance tests/sequences to validate AES-GCM & GHASH() implementation? Details: I'm implementing AES-GSM, that's just for better understanding of that stuff, nothing more. Well I ...
1
vote
1answer
39 views

Number message limits of Galois/Counter Mode (GCM) per key

In https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf page 27, it is said that ...the total number of blocks of plaintext and AAD that are protected by invocations of the ...
1
vote
1answer
290 views

Proper way of encrypting large files with AES-256-GCM

I would like to encrypt and decrypt files with AES-256-GCM. I need a solution that works with Java, PHP and JavaScript. In practice, users can upload, download files via web browser and/or desktop app ...
1
vote
1answer
86 views

Safe way to derive IV from the DH shared keys for AES-GCM?

I am preparing to use AES-GCM to make a secure communication program. Here is the procedure DH key exchange to get shared keys SHA256(shared keys) Use AES-GCM to encrypt a message while the key only ...
1
vote
1answer
272 views

Using AES-GCM (or AEAD ciphers in general) as a pure MAC without encryption

What's the opinion on using an AEAD cipher such as AES-GCM for example as a pure message authentication code (MAC) when only message authentication but not encryption is required. does it bring any ...
1
vote
1answer
681 views
1
vote
1answer
266 views

lookup encrypted text by clear text without decryption

I've implemented vouchers module in my web project where I use it to generate redeem get etc... vouchers. since voucher codes are considered sensitive, I've considered to encrypt them using AES-GCM. ...
1
vote
1answer
976 views

AES-GCM GHASH calculation;

I'm trying to make an GHASH() function and need some clarification. Implementation is based on gcm-spec. Page 8 describes polynomial mult and page 27 has a "Test Case 2" which I use to verify result. ...
1
vote
1answer
94 views

Will AES-GCM smaller sized tag (mac) be included in larger sized tag

I want to make sure that I understand AES-GCM correctly: If I have: key1, plaintext1, iv1, adata1 and requset tag size of 96 bits, and tag size of 128 bits, will the first 12 bytes of the 128 bits ...
1
vote
1answer
431 views

Is using ECDSA with AES-GCM viable?

I'm pretty new to the whole cryptography scene, so please forgive me if I make any incorrect statements. I have a 16MB image that I'm encrypting and authenticating using AES-GCM. I obtain a 16MB ...
1
vote
0answers
63 views

Store symmetrical (AES) key in Indexeddb?

Using web crypto API and it won't let me store an AES key in the indexeddb (it requires a public/private key). Does anyone have suggestions on how to do this? Should I/could I create a public/private ...
1
vote
0answers
105 views

AES-GCM - what are “Payload Length” and “AAD Length”

For the AES-GCM mode within many cryptomodules, their FIPS-validation certificates list the options: Payload Length: 504, 512, 1016, 1024 AAD Length: 0, 504, 512, 1016, 1024 For example in OpenSSL, "...
1
vote
1answer
89 views

Decrypt authenticated cipher while still encrypting [duplicate]

Normal AES-GCM generates an authentication tag at the end of encryption. I want to decrypt it while it is still being encrypted. This would be useful to send, encrypt, receive and decrypt a large file ...
0
votes
2answers
922 views

Which is slower, AES or GCM hash (GHASH), if CPU has no special instructions?

In an answer to this question: Security of GCM if Implemented with Stream Cipher instead of Block Cipher ...it was stated that: The GHASH part of GCM is usually the problematic one when it comes to ...
0
votes
2answers
2k views

Appropriate key for AES 256 GCM

I am updating a system that has Rails' OpenSSL on one side and Python's cryptography.io on the other. The Rails side has to generate keys for the AES-256-GCM and here are two methods that appear to ...
0
votes
2answers
914 views

Inverse MixColumns Operation of AES

I am aware that MixColumns is a mixing operation which operates on the columns of the state, combining the four bytes in each column. So we multiply our state with ...
0
votes
2answers
51 views

AES ECB deterministic encryption to perform Private set intersection

There are two parties, and each has a list of plain-texts. My end goal is to assign indices to unique plain-texts across both parties. My present approach is the following. Both parties perform a ...
0
votes
2answers
133 views

If all encrypt algorithms in TLS1.3 ciphersuites are AEAD , why do they keep including a Hash algorithm?

In TLS1.3 all allowed algorithms included in cipher suites are AEAD, which means they don't just encrypt but they authenticate too (thus if I don't misunderstand, they give not only confidentiality ...
0
votes
1answer
331 views

Why AES 256 GCM is more preferred by email service providers / banks over the fast and efficient ChaCha20 - Poly1305?

This question is based on my recent observation of preferences of certain email service providers and banks to use AES related symmetric ciphers over the more fast ChaCha20 Poly1305 . For example ...
0
votes
1answer
109 views

Asymmetric or Symmetric encryption

I'm currently looking into OpenSSL and its API and I'm not really familiar with cryptography. So I was looking at the example on asymmetric encryption of an envelope. And it says the message is ...
0
votes
1answer
5k views

Proper implementation of AES-256-GCM with PHP OpenSSL [closed]

I am really lost in this subject, I find it hard to get any reliable documentation on the subject that is a bit friendly for beginners like me. So I apologize in advance if this question would sound ...
0
votes
1answer
121 views

TLS 1.2 AES-GCM decryption problem

I'm trying to decrypt a PCAP encrypted with TLS 1.2. I have the private key and Wireshark is able to decrypt the data so what I am doing should work but there is obviously something wrong. The ...
0
votes
1answer
68 views

Is encryption with the Web Cryptography API resistant against side channel attacks?

If I want to encrypt some payload with AES-GCM, with the Web Cryptography API, how resistant would this be against side channel attacks?
0
votes
1answer
67 views

Can I use a fixed IV with AES-GCM if I only encrypt unique plaintext values? [duplicate]

My use case guarantees that all plaintext values are unique. In this case, is it safe to use a fixed IV with AES-GCM to carry our encryption/decryption?
0
votes
1answer
160 views

Is the AES-GCM encryption using the SHA256 hash of the plaintext as IV secure?

I want to encrypt a list of unique values and I want the property of when I encrypt the same value I get the same ciphertext (determinism). The adversary only observes the ciphertexts of a unique set ...