Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

The Galois Counter Mode, an authenticated encryption mode of operation for a block cipher.

2
votes
1answer
43 views

GCM decryption and clear text processing

When using GCM mode decryption, is it necessary to wait for the decryption to complete, (and thus being able to see if the integrity of cipher text is OK) before beginning processing the clear text ...
1
vote
0answers
17 views

How is GCM Parallelizeable? [duplicate]

The Wikipedia article on GCM says GCM can take full advantage of parallel processing. I had thought GCM uses a random IV for the first block, then for the second ...
2
votes
1answer
27 views

What would be an adversary advantage in case of GCM authentication?

Philip Rogaway has written a formula for CCM mode where the adversary advantage is given as: $$adversary\_advantage \leq \frac{q_{dec}}{2^t} + \frac{\sigma^2}{2^b}$$ Can we use this formula to find ...
0
votes
1answer
87 views

AES-GCM GHASH calculation;

I'm trying to make an GHASH() function and need some clarification. Implementation is based on gcm-spec. Page 8 describes polynomial mult and page 27 has a "Test Case 2" which I use to verify result. ...
5
votes
0answers
67 views

GCM mode of operation with long-term keys

Cross-post: https://cstheory.stackexchange.com/q/41435/873 Regarding GCM, NIST specifies the following: The total number of invocations of the authenticated encryption function shall not exceed $2^...
1
vote
1answer
219 views

Which one is faster GCM AES-128 or Curve25519?

As I know the symmetric encryption algorithms are faster than asymmetric encryption algorithms. But when I test GCM AES-128 and Curve25519 encryption time. I find Cure25519 are faster then GCM AES-128....
1
vote
2answers
330 views

Is it safe to use a timestamp to build a nonce?

I'm writing an application, which can be used on multiple clients, and share data on a server. To make sure the data never leaves the clients unencrypted, the application should offer encryption with ...
2
votes
1answer
57 views

GCM mode of operation and IV size less 96 bits

GCM specification defines the initial counter value $Y_0$ for encryption/decryption operations as follows: $$ Y_0=\begin{cases} IV||0^{31}1 &\text{if len}(IV)=96\\ GHASH(H,\{\},IV)& \text{...
0
votes
2answers
88 views

Is it safe to use a counter as IV for AES256-GCM

What if I will use 96-bit integer counter starting from 0 as IV for AES256-GCM cipher. Is it safe? Is there any other ways to ensure uniqueness of IV for GCM cipher?
2
votes
1answer
79 views

Why is GCM not vulnerable at the birthday bound for 128 bit IV?

According to this article, which looks at attacks on Caesar candidates beyond what they claim, they include an attack on page 6 for nonce-respecting adversaries for AES-GCM which allows IVs longer ...
0
votes
2answers
164 views

Which is slower, AES or GCM hash (GHASH), if CPU has no special instructions?

In an answer to this question: Security of GCM if Implemented with Stream Cipher instead of Block Cipher ...it was stated that: The GHASH part of GCM is usually the problematic one when it comes to ...
0
votes
0answers
14 views

Can Galois/counter mode be used for stream ciphers (Galois/stream mode)? [duplicate]

The authenticated encryption mode of operation Galois/counter mode has recently gained acceptance because of its high performance due to its inherent parallelism and no pipeline stalls. It requires a ...
7
votes
1answer
460 views

TLS 1.2 Cipher Suites With AES-GCM – What data (if any) is passed to the AES-GCM cipher as the Additional Authentication Data?

TLS 1.2 defines a number of cipher suites that employ AES-GCM, e.g.: ...
3
votes
1answer
68 views

GCM mode GHASH sensitivity to timing attacks

In GCM mode of authenticated encryption, is it a security concern if the GHASH implementation timing can vary? If the timing varies according to the AAD/ciphertext data, it looks as though that doesn'...
3
votes
2answers
87 views

GCM mode and the order of AAD and plaintext

In GCM mode of encryption, what are the limitations on the mixing of plaintext and AAD (additional authenticated data)? Must the AAD come before the plaintext? Or could it be after the plaintext ...
2
votes
2answers
64 views

Generate $J_0$ for GCM cipher when $\operatorname{len}(IV) \neq 96$ bits

I have the following questions about the construction of J0 when is not equal to 96 bits, $s= 128\big\lceil \operatorname{len}(\text{IV})/128\big\rceil-\operatorname{len}(\text{IV})$ For example if ...
2
votes
0answers
59 views

How to break GCM that uses the same IV

I have an implementation that natively uses the same IV (12 bytes of 0) for all encryption. The key is always a 32 byte SHA-512 hash. I know via this post that I ...
1
vote
2answers
105 views

Does GHASH use XOR or addition?

I've been looking into GHASH and some sites describe it as a polynomial: A1*(H* *M-1)+A2*(H* *M-2)...C1*H(H* *M-N)+C2*H(H* *(M-N-1))...+len(A||C)*H+E(0)=t while ...
1
vote
1answer
391 views

AES-CBC then SHA vs AES-GCM for encrypting and authenticating a web token

I am trying to have something like JWT but kinda ad hoc and encrypted. The token itself is simply a stringified JSON that contains the user ID and Unix timestamp. Now, I tried to use AES-128-GCM, ...
2
votes
1answer
84 views

Do aes_256_gcm IVs just need to be unique for that key?

I'm using GCM (via openssl's EVP_EncryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL))). The IV's default length is 12 bytes. It says that the IV must be ...
0
votes
2answers
84 views

Does AES-GCM without security tag turn into regular CTR Mode?

We are looking to implement a simple password based key agreement scheme. Part of this is deriving a symmetric key from a common passphrase known to both parties involved. This symmetric key is then ...
1
vote
1answer
202 views

Would it be safe to store GCM nonce in the encrypted output?

I'm looking to use AES-256 GCM to encrypt and authenticate a file containing sensitive information. I am a bit loss on where to store the nonce that is required for GCM. Would it be adequate/safe to ...
1
vote
1answer
41 views

GCM cipher M0 tables : semantic questions on how to implement GCM

I`m reading the PDF "The Galois/Counter Mode of Operation (GCM)". In section 4.1 on the optimization of multiplications with tab, in algorithm 3 I have the following questions: A vector called M with ...
0
votes
1answer
187 views

MAC size 128 bits or more?

Just a quick question: I've seen implemented BouncyCastle's class AeadParameters with MAC length of 128 bits, which was allegedly recommended. Though when I looked up HMac to implement my own MAC in ...
4
votes
2answers
179 views

Is it possible to recover AES-GCM plaintext when having everything but the additional data?

I'm using the window.crypto library in browsers. I use iv from window.crypto.getRandomValues...
1
vote
1answer
36 views

Does GCM need to incorporate the length of the associate data and the length of the ciphertext to be secure?

What is the reason for incorporating the lengths of the associated data and ciphertext into the calculation of the authentication tag in GCM? Is it for security?
6
votes
2answers
170 views

IV in Galois Counter Mode

I am looking at Wikepedia Galois Counter Mode article. I see this diagram I am trying to figure out where the IV works its way in. Is it used to initialize the counter? If so, how does a sequence of ...
10
votes
1answer
159 views

AES cache-timing attacks and nonce-based operation modes

As I understand it, AES cache-timing attacks exploit the execution time variations due to cache hits/misses, especially the ones depending on the SBox look-up tables which are key-related. To mount ...
0
votes
0answers
44 views

Using OpenSSL to emulate LTO 4 tape encryption

I have a mix of LTO 4 and LTO 3 tapes I would like to encrypt data on to. LTO 4 has built in encryption - load they key into the drive, and it handles the AES-256-GCM encyption transparently. LTO 3 ...
0
votes
1answer
60 views

Why not generate the authentication key from the key and nonce in GCM?

In Galois/counter mode, the authentication key $H$ is leaked if two distinct messages are encrypted using the same nonce. If someone did end up doing that, then they would need to rekey to get a new $...
6
votes
1answer
108 views

Is this a typo/error in the Galois/Counter mode specification or have I misunderstood?

I've been reading the following document describing Galois Counter Mode: The Galois/Counter Mode of Operation On page 7 of the document, the following diagram describes the ...
1
vote
1answer
169 views

Is GCM mode of authenticated encryption quantum secure?

Regarding post-quantum symmetric cryptography, it has been recommended to move to AES-256 or similar ciphers with 256-bit keys. How is authenticated encryption affected? Is AES-256-GCM considered ...
2
votes
1answer
72 views

GCM and decrypting with Krack

I'm trying to understand how Krack works on GCM. I thought that looking at GCM would be easier since it's a full break and the video shows a tool that is able to decrypt everything. I see that the IV ...
1
vote
1answer
154 views

Is the nonce in GCM mode used as key for HMAC? And how to send it?

So, my believe is that, in some way, GCM mode or any other authenticated encryption mode is useful to provide encryption and integrity for the ciphertext altogether instead of having to handle the ...
6
votes
1answer
232 views

Security of GCM if Implemented with Stream Cipher instead of Block Cipher

Can GCM be implemented with a stream cipher instead of a block cipher? If no, then what security flaw does it have? If yes, then which possibility from below two is better in terms of security? In ...
6
votes
1answer
299 views

Are tags longer than 128 bit possible for AES-256-CCM and AES-256-GCM?

I have an existing application that uses AES-256-CBC for encrypting data blocks, and HMAC-SHA-256 on the plaintext for eliminating duplicate data blocks. For performance reasons, I would like to move ...
-1
votes
1answer
600 views

AES GCM in swift 3 [closed]

I have an API which needs data encripted using AES/GCM/NoPadding. But in various posts in the internet I have read that apple has removed the GCM from the common crypto library. Could any one tell a ...
1
vote
2answers
125 views

The purpose of ADATA in GCM

I have a hard time understanding the purpose of ADATA in GCM algorithm. Is ADATA the plaintext itself we would like to encrypt or is it some random data as for the IV ? Otherwise from what I have ...
0
votes
0answers
129 views

Do I need to worry about the IV if I use a 32 byte random salt with SCrypt and AES-GCM?

I am encrypting a DEK (data encryption key) with a KEK (key encryption key). The KEK is generated from a password using scrypt with default parameters and a 32 byte randomly generated salt. The ...
2
votes
1answer
182 views

AES mode which verifies data integrity AFTER decryption

I wonder if there is an AES mode which would verify data integrity after decryption operation. Due to the reasons which does not matter here, there is a possibility that AES implementation I use may ...
3
votes
1answer
290 views

Is it a vulnerability (for message authentication) to have a variable iteration-count for PBKDF2?

The scenario: A user clicks on an encrypted file, and enters his password, in order to decrypt and authenticate it using HMAC (when its key is derived using PBKDF2). If the iteration-count is fixed, ...
1
vote
0answers
109 views

Can we use different mode for decryption instead of using mode which is used in encryption?

I am decrypting the Apple Payment Token in Demandware, the apple pay token is encrypted in GCM mode, but in Demandware, we don't have GCM mode in Cipher class, so can I use other modes for decryption? ...
9
votes
1answer
1k views

How was the GCM polynomial found?

As far as I understand, there is no general way to enumerate irreducible polynomials in a particular finite field, which are similar in nature to prime numbers over the integers. The GCM mode finite ...
1
vote
1answer
71 views

Is creating an authentication-key (mac) from the encryption password a vulnerability?

I can think of at least one problem with it - that testing for a correct key (when brute forcing) is simpler with a mac key (at least for short messages) and therefore can help brute force decryption.
3
votes
1answer
177 views

Can I derive an IV as a segment counter for AES256-GCM?

I'm writing a software that will be encrypting & authenticating segments of data, each 4096 bytes long. These segments are saved to disk in a sequential order that will never change. So I was ...
9
votes
2answers
946 views

GCM as a general purpose cryptographic hash?

Why are hash functions (e.g SHA-3) so complicated when GCM apparently provides secure hashing and has a relatively simple construction? Is this purely about speed? I imagine that GMAC with a fixed ...
1
vote
1answer
590 views
0
votes
1answer
188 views

PBEWithHmacSHA512AndAES_128 and AES Modes like GCM [closed]

I've asked this question on stackoverflow And I think one gentleman has already answered the first part of question a) In my code i am keeping IV and salt with ciphertext. I wanted to use ...
2
votes
1answer
861 views

AES-GCM — what is ICV and what happens if I don't use it

I am interested in using AES-GCM and after hours of reading on Internet I still have a few questions: What will ensure the ICV, is it only Integrity ? If I don't need it on my purpose, can I spare it ...
3
votes
1answer
574 views

Why is the GHASH output in GCM mode encrypted to calculate the tag?

To calculate the authentication tag in the Galois/Counter mode (GCM), first a MAC is calculated using GHASH over the cipher text and the additional data. After that, this MAC is encrypted using GCTR (...