Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [gcm]

The Galois Counter Mode, an authenticated encryption mode of operation for a block cipher.

0
votes
1answer
22 views

Using key derived using HKDF or NIST sp800-108 with AES-CCM/GCM

Is it safe to use keys derived using HKDF or NIST sp800-108 with AES-CCM/GCM ? The NIST SP800-108 and SP*00-56C spec says "To comply with this Recommendation, the derived keying material shall not be ...
2
votes
1answer
52 views

What should I use for consequent AES key derivation?

I am writing a small chat program to explore some methods and concepts in cryptography and currently I am using a shared AES key tunneled with RSA which upon further reading revealed many flaws both ...
2
votes
2answers
298 views

AES256 GCM IV guidelines

If I use for example AES256 (GCM), and my message is bigger than 256bit (breaked into smaller 256bit blocks for encryption), should the IV change every 256bit of the message?
4
votes
1answer
56 views

How to handle the extra 12451 elements in Sophie-Germain Counter Mode?

In Sophie-Germain Counter Mode (SGCM), the $GF(2^{128})$ field multiplication of Galois Counter Mode (GCM) is replaced with normal multiplication $\bmod 2^{128}+12451$. Because the block size is 128 ...
9
votes
1answer
203 views

how does BearSSL's GCM modular reduction work?

BearSSL (in src/hash/ghash_ctmul.c) seems to be doing a modular reduction that I don't completely understand. Here's the code: ...
0
votes
1answer
34 views

How can you determine how long the MAC for GCM must be?

I want to use AES-GCM to encrypt 7 Byte data chunks. A 16 Byte MAC seems like overkill to me and the library I'm using gives me the option to make the MAC smaller. ...
7
votes
0answers
110 views

GCM with reversed poly

These slides talk about how GCM can be sped up if one uses $x^{128}+x^{127}+x^{126}+x^{121}+1$ as the reduction polynomial instead of $x^{128}+x^7+x^2+x^1+1$. When one is doing that one needs to ...
1
vote
1answer
42 views

With AES-GCM, may I use multiple tags per key?

In my implementation of AES-GCM, the key might change only once per minute. However, I wish to calculate a new tag every 6us, to reduce latency (since you have to buffer up a GCM "packet" before ...
1
vote
2answers
64 views

Implementations of GCM with 64-bit cipher

The paper The Galois/Counter Mode of Operation (GCM) describes mainly the 128-bit case, for use with 128-bit block ciphers such as AES. AES-GCM test vectors are available from NIST. The paper also ...
1
vote
2answers
90 views

how does AES GCM in SSH work?

I was looking at RFC5647: AES Galois Counter Mode for the Secure Shell Transport Layer Protocol and had some questions about section 7.1 "IV and Counter Management". Here's that section: ...
5
votes
1answer
527 views

Why doesn't the GCM spec use a more efficient multiplication algorithm?

NIST SP 800-38D § 6.3 Multiplication Operation on Blocks describes a multiplication algorithm that, in my testing, appears to be a good amount slower then algorithm 2.40 (arbitrary reduction ...
1
vote
1answer
47 views

GHASH with a finite field multiplication algorithm in reverse order

NIST SP 800-38D § 6.4 GHASH Function describes the GHASH algorithm thusly: Prerequisites: block $H$, the hash subkey. Input: bit string $X$ such that len($X$) = $128m$ for some positive ...
0
votes
1answer
39 views

modular reduction algorithm over $F_{2^m}$ doesn't seem to work when order of polynomial being reduced is small

I was considering algorithm 2.40 (arbitrary reduction polynomials) in the Guide to Elliptic Curve Cryptography and... it doesn't appear to work when the order of the polynomial you're trying to ...
2
votes
1answer
27 views

Are Authenticated Encryption ciphersuites supported in legacy TLS versions older than TLS 1.2?

I have read in a paper that Authenticated Encryption (by this I mean those that support GCM mode or ChaCha20 ciphers) are not supported in versions older than TLS 1.2? I could not confirm this as ...
1
vote
1answer
59 views

Does re-transmission really reduce security?

I am using AES with GCM and a colleague told me "Repeating a VCC with the same key and a different message reduces the security of the key." He did not have any additional detail to offer. What he ...
1
vote
1answer
174 views

CBC related TLS cipher suites to be disabled in the server side

I understand the TLS cipher suites using CBC mode are susceptible to timing attacks. From that understanding it seems that the cipher suites using GCM (CTR-based) are safe to use considering they don'...
2
votes
1answer
59 views

GCM decryption and clear text processing

When using GCM mode decryption, is it necessary to wait for the decryption to complete, (and thus being able to see if the integrity of cipher text is OK) before beginning processing the clear text ...
1
vote
0answers
23 views

How is GCM Parallelizeable? [duplicate]

The Wikipedia article on GCM says GCM can take full advantage of parallel processing. I had thought GCM uses a random IV for the first block, then for the second ...
2
votes
1answer
43 views

What would be an adversary advantage in case of GCM authentication?

Philip Rogaway has written a formula for CCM mode where the adversary advantage is given as: $$adversary\_advantage \leq \frac{q_{dec}}{2^t} + \frac{\sigma^2}{2^b}$$ Can we use this formula to find ...
0
votes
1answer
254 views

AES-GCM GHASH calculation;

I'm trying to make an GHASH() function and need some clarification. Implementation is based on gcm-spec. Page 8 describes polynomial mult and page 27 has a "Test Case 2" which I use to verify result. ...
7
votes
0answers
79 views

GCM mode of operation with long-term keys

Cross-post: https://cstheory.stackexchange.com/q/41435/873 Regarding GCM, NIST specifies the following: The total number of invocations of the authenticated encryption function shall not exceed $2^...
1
vote
1answer
350 views

Which one is faster GCM AES-128 or Curve25519?

As I know the symmetric encryption algorithms are faster than asymmetric encryption algorithms. But when I test GCM AES-128 and Curve25519 encryption time. I find Cure25519 are faster then GCM AES-128....
1
vote
2answers
466 views

Is it safe to use a timestamp to build a nonce?

I'm writing an application, which can be used on multiple clients, and share data on a server. To make sure the data never leaves the clients unencrypted, the application should offer encryption with ...
2
votes
1answer
80 views

GCM mode of operation and IV size less 96 bits

GCM specification defines the initial counter value $Y_0$ for encryption/decryption operations as follows: $$ Y_0=\begin{cases} IV||0^{31}1 &\text{if len}(IV)=96\\ GHASH(H,\{\},IV)& \text{...
1
vote
2answers
196 views

Is it safe to use a counter as IV for AES256-GCM

What if I will use 96-bit integer counter starting from 0 as IV for AES256-GCM cipher. Is it safe? Is there any other ways to ensure uniqueness of IV for GCM cipher?
2
votes
1answer
100 views

Why is GCM not vulnerable at the birthday bound for 128 bit IV?

According to this article, which looks at attacks on Caesar candidates beyond what they claim, they include an attack on page 6 for nonce-respecting adversaries for AES-GCM which allows IVs longer ...
0
votes
2answers
257 views

Which is slower, AES or GCM hash (GHASH), if CPU has no special instructions?

In an answer to this question: Security of GCM if Implemented with Stream Cipher instead of Block Cipher ...it was stated that: The GHASH part of GCM is usually the problematic one when it comes to ...
0
votes
0answers
21 views

Can Galois/counter mode be used for stream ciphers (Galois/stream mode)? [duplicate]

The authenticated encryption mode of operation Galois/counter mode has recently gained acceptance because of its high performance due to its inherent parallelism and no pipeline stalls. It requires a ...
7
votes
1answer
834 views

TLS 1.2 Cipher Suites With AES-GCM – What data (if any) is passed to the AES-GCM cipher as the Additional Authentication Data?

TLS 1.2 defines a number of cipher suites that employ AES-GCM, e.g.: ...
3
votes
1answer
127 views

GCM mode GHASH sensitivity to timing attacks

In GCM mode of authenticated encryption, is it a security concern if the GHASH implementation timing can vary? If the timing varies according to the AAD/ciphertext data, it looks as though that doesn'...
3
votes
2answers
114 views

GCM mode and the order of AAD and plaintext

In GCM mode of encryption, what are the limitations on the mixing of plaintext and AAD (additional authenticated data)? Must the AAD come before the plaintext? Or could it be after the plaintext ...
3
votes
2answers
111 views

Generate $J_0$ for GCM cipher when $\operatorname{len}(IV) \neq 96$ bits

I have the following questions about the construction of J0 when is not equal to 96 bits, $s= 128\big\lceil \operatorname{len}(\text{IV})/128\big\rceil-\operatorname{len}(\text{IV})$ For example if ...
2
votes
0answers
74 views

How to break GCM that uses the same IV

I have an implementation that natively uses the same IV (12 bytes of 0) for all encryption. The key is always a 32 byte SHA-512 hash. I know via this post that I ...
1
vote
2answers
112 views

Does GHASH use XOR or addition?

I've been looking into GHASH and some sites describe it as a polynomial: A1*(H* *M-1)+A2*(H* *M-2)...C1*H(H* *M-N)+C2*H(H* *(M-N-1))...+len(A||C)*H+E(0)=t while ...
2
votes
1answer
878 views

AES-CBC then SHA vs AES-GCM for encrypting and authenticating a web token

I am trying to have something like JWT but kinda ad hoc and encrypted. The token itself is simply a stringified JSON that contains the user ID and Unix timestamp. Now, I tried to use AES-128-GCM, ...
2
votes
1answer
197 views

Do aes_256_gcm IVs just need to be unique for that key?

I'm using GCM (via openssl's EVP_EncryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL))). The IV's default length is 12 bytes. It says that the IV must be ...
0
votes
2answers
118 views

Does AES-GCM without security tag turn into regular CTR Mode?

We are looking to implement a simple password based key agreement scheme. Part of this is deriving a symmetric key from a common passphrase known to both parties involved. This symmetric key is then ...
1
vote
1answer
316 views

Would it be safe to store GCM nonce in the encrypted output?

I'm looking to use AES-256 GCM to encrypt and authenticate a file containing sensitive information. I am a bit loss on where to store the nonce that is required for GCM. Would it be adequate/safe to ...
1
vote
1answer
43 views

GCM cipher M0 tables : semantic questions on how to implement GCM

I`m reading the PDF "The Galois/Counter Mode of Operation (GCM)". In section 4.1 on the optimization of multiplications with tab, in algorithm 3 I have the following questions: A vector called M with ...
0
votes
1answer
317 views

MAC size 128 bits or more?

Just a quick question: I've seen implemented BouncyCastle's class AeadParameters with MAC length of 128 bits, which was allegedly recommended. Though when I looked up HMac to implement my own MAC in ...
4
votes
2answers
257 views

Is it possible to recover AES-GCM plaintext when having everything but the additional data?

I'm using the window.crypto library in browsers. I use iv from window.crypto.getRandomValues...
1
vote
1answer
38 views

Does GCM need to incorporate the length of the associate data and the length of the ciphertext to be secure?

What is the reason for incorporating the lengths of the associated data and ciphertext into the calculation of the authentication tag in GCM? Is it for security?
6
votes
2answers
330 views

IV in Galois Counter Mode

I am looking at Wikepedia Galois Counter Mode article. I see this diagram I am trying to figure out where the IV works its way in. Is it used to initialize the counter? If so, how does a sequence of ...
10
votes
1answer
179 views

AES cache-timing attacks and nonce-based operation modes

As I understand it, AES cache-timing attacks exploit the execution time variations due to cache hits/misses, especially the ones depending on the SBox look-up tables which are key-related. To mount ...
0
votes
0answers
59 views

Using OpenSSL to emulate LTO 4 tape encryption

I have a mix of LTO 4 and LTO 3 tapes I would like to encrypt data on to. LTO 4 has built in encryption - load they key into the drive, and it handles the AES-256-GCM encyption transparently. LTO 3 ...
0
votes
1answer
89 views

Why not generate the authentication key from the key and nonce in GCM?

In Galois/counter mode, the authentication key $H$ is leaked if two distinct messages are encrypted using the same nonce. If someone did end up doing that, then they would need to rekey to get a new $...
6
votes
1answer
113 views

Is this a typo/error in the Galois/Counter mode specification or have I misunderstood?

I've been reading the following document describing Galois Counter Mode: The Galois/Counter Mode of Operation On page 7 of the document, the following diagram describes the ...
1
vote
1answer
250 views

Is GCM mode of authenticated encryption quantum secure?

Regarding post-quantum symmetric cryptography, it has been recommended to move to AES-256 or similar ciphers with 256-bit keys. How is authenticated encryption affected? Is AES-256-GCM considered ...
2
votes
1answer
77 views

GCM and decrypting with Krack

I'm trying to understand how Krack works on GCM. I thought that looking at GCM would be easier since it's a full break and the video shows a tool that is able to decrypt everything. I see that the IV ...
1
vote
1answer
196 views

Is the nonce in GCM mode used as key for HMAC? And how to send it?

So, my believe is that, in some way, GCM mode or any other authenticated encryption mode is useful to provide encryption and integrity for the ciphertext altogether instead of having to handle the ...