Questions tagged [gcm]

The Galois Counter Mode, an authenticated encryption mode of operation for a block cipher.

Filter by
Sorted by
Tagged with
1
vote
3answers
43 views

AES GCM : is it acceptable to return the wrong plaintext if the tag is incorrect?

Let's start by saying I'm no crypto expert, I'm just a dev, so feel free to correct me (using words, not downvotes) if what I'm saying is non-sense. Context : I'm doing some crypto as a service for ...
0
votes
2answers
24 views

what is auth data in AES-GCM

I am trying to understand AES-GCM and I do not understand what I should transmit to Auth Data during encryption. What kind of data is that?
0
votes
1answer
51 views

AES/GCM/PKCS5Padding giving issues while AES/CBC/PKCS5Padding works fine for my use case

I have a requirement to read-encypt-save plus its reverse i.e. read-decypt-save files through chunk/block mechanism (single operation not feasible because of huge(GBs) file sizes). So essentially the ...
0
votes
0answers
19 views

Why does AES_GCM sometimes has a SHA for integrity? [duplicate]

For example the following suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 From what I understand the SHA384 at the end is used to authenticate the message, which is exactly what MAC does, and the mode ...
4
votes
1answer
97 views

How does GHASH used in GCM behave as a universal hashing function?

As per my understanding, a Universal Hash Function isn't a cryptographic hash function & it's output isn't uniformly distributed. However, this is still secure because it's actually a family of ...
3
votes
1answer
63 views

What are the implications of allowing a zero-length GCM nonce?

NIST SP800-38D section 5.2.1.1 is clear that empty nonces are not allowed with GCM, but without explaining the reasoning. My assumption was this is simply because the probability of error (encrypting ...
2
votes
1answer
97 views

What is the overhead of GCM? And how are GCM tags signed by RSA/PKI?

I'm mainly trying to wrap my head around the pipeline of encryption, hashing and signing. I've read over this question, describing the overhead of GCM, which I understand to be configurable for space-...
0
votes
0answers
61 views

Is this a reasonable design for encrypting records in a key/value database?

A while back I designed a protocol for en encrypted key/value service. My main goal was to minimize the value of a breached database by using cryptographic algorithms where a brute-force cracking ...
1
vote
1answer
79 views

Is a stream cipher and a (cryptographically secure) PRNG nearly the same thing?

If I let the authentification tag aside (which is important), encrypting with AES-GCM and a fixed key and nonce: ...
3
votes
2answers
317 views

Does it make any sense to sign a GCM authentication tag with RSA?

To achieve double insurance for authentication, can we sign the GCM final tag with using RSA? with RSA, no one is able to create his own tag since the private key is not known. However, according to ...
5
votes
1answer
143 views

How to securely encrypt/decrypt data with a maximum chunk size?

I am aware of the different modes so that a "raw" block cipher such as AES (ECB) can be used to encrypt more than a single block of data (CBC, OFB, CTR, etc) and modes such as AES-GCM which ...
3
votes
3answers
265 views

Designing a secure UDP-based communication protocol

SUMMARY UPDATE: I have changed the title of this question from "Using an encrypted packet counter as a counter value in AES-CTR" to "Designing a secure UDP-based communication protocol&...
4
votes
0answers
140 views

Is AES-GCM-SIV with fixed IV deterministic authenticated encryption?

Is there any functional or strong security difference beyond speed between AES-GCM-SIV with implicit fixed public IV and no additional data AES-CTR (or AES-OFB) with 128-bit IV computed per HMAC-SHA-...
1
vote
1answer
205 views

Is it dangerous to encrypt lots of small files with the same key?

I want to encrypt 1000s of old files on old hard drives before uploading them to the cloud. I'm planning to use AES-GCM with only one or a few keys. (I'm using Apple's CryptoKit library which provides ...
3
votes
1answer
104 views

AES-GCM ciphertext that deciphers under two keys

How can we exhibit an AES-GCM ciphertext, including IV and 128-bit authentication tag, and distinct keys $K_0$ and $K_1$, so that decryption succeeds for both keys? What degree of control do we have ...
2
votes
3answers
343 views

Can AES GCM mode detect an incorrect key and refuse to decrypt?

I understand that AES in GCM mode produces an authentication tag that is used to ensure that a tampered with cipher text is not decrypted. However, if I pass the wrong key will AES in GCM mode detect ...
0
votes
1answer
153 views

Is XTS always better than GCM?

XTS is suitable for disk encryption while GCM doesn't. Both require the same number of block encryption calls. Both are parallel in encryption and decryption. XTS is actually even faster in openssl ...
2
votes
1answer
31 views

Best suitable column type for openssl $tag,$iv,$key,$encrypted?

Which column type is best for storing $tag, $iv, $key, $encryptedData generated by openssl_encryption, and in which format I should save these values? I am using &...
1
vote
1answer
48 views

Number message limits of Galois/Counter Mode (GCM) per key

In https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf page 27, it is said that ...the total number of blocks of plaintext and AAD that are protected by invocations of the ...
3
votes
2answers
145 views

Extending AES-GCM initialization vector

We all know that applications of crypto primitives like to not think about the management of nonces, and initialization vectors and often prefer to just set them to random values. This sometimes leads ...
2
votes
2answers
715 views

AES-GCM: Verification before Decryption

I am looking at ChaCha20Poly1305 WolfSSL. It is noted that the ChaCha20Poly1305 AEAD construction has the property, that it only outputs the plaintext, if the verification of the MAC (Authentication ...
0
votes
0answers
23 views

Authenticating and encrypting data for an automated system

I wish to distribute a file from A to an automated system B. The requirements are: Contents are encrypted Contents are tamper proof Contents origin is verified To do this I have devised the ...
2
votes
1answer
204 views

The Security of AES-N-GCM

In the paper The Security and Performance of the GaloisCounter Mode(GCM) of Operation,it shows the AES GCM SECURITY in Corollary 1. there are no distinguishing attacks against AES-N-GCM that work ...
1
vote
1answer
54 views

Implications of Shor's algorithm on $F_{2^m}$ elliptic curves and GHASH

The security of elliptic curves depends on the difficulty of the discrete logarithm problem. Should Shor's Algorithm ever prove viable then elliptic curves would cease to offer any useful security ...
3
votes
1answer
89 views

GCM Construction of table M0

I am reading the paper on GCM The Galois/Counter Mode of Operation (GCM) . I have some doubts about the implementation of table M0 and R. When I have to multiply by the variable P it is ...
0
votes
1answer
75 views

GCM Create M tables and R

I am trying to optimize GCM multiplication. This PDF explains GCM: The Galois/Counter Mode of Operation (GCM) The algorithms are in section 4.1 In algorithm 3 I have to multiply table M [128] ...
0
votes
1answer
67 views

Does the authentification in GCM serve the same purpose as CRC32?

The purpose of the authentification is to ensure the data integrity. Let's just focus on the authentification part of the GCM which is using the Galois field multiplication to create an ...
3
votes
1answer
95 views

Is there an increased risk of nonce reuse when using GCM with a nonce more than 96 bits?

GCM is designed to use a 96-bit nonce, which can be generated either randomly or deterministically. If you use a nonce that isn't 96 bits then it is padded and hashed with GHASH to create a ...
1
vote
1answer
112 views

Safe way to derive IV from the DH shared keys for AES-GCM?

I am preparing to use AES-GCM to make a secure communication program. Here is the procedure DH key exchange to get shared keys SHA256(shared keys) Use AES-GCM to encrypt a message while the key only ...
0
votes
1answer
66 views

Does Camellia-GCM use Camellia-CTR to create GCM Hash?

I'm still confused when reading GnuTLS/Nettle implementation about Camellia-GCM.
1
vote
2answers
314 views

Can an AES-GCM be cracked if the key is known but the nonce isn't?

I'm kind of new in this field and I've been trying to learn it. I'm now facing an issue where I have a couple of packages encrypted with AES-128 GCM and I have the key that was used to encrypt these ...
5
votes
1answer
98 views

Line by line encrypted logging stored with iv/salt/iterations. How safe is it?

I'm building an encrypted logging application. Log entries are encrypted with AES-256-GCM, using password-derived keys with PBKDF2. The application must support log rotation, and I would like to make ...
0
votes
0answers
54 views

Can I use aes-gcm to authenticate a user based on his ability to decrypt a payload?

I'd like to authenticate my users without storing their password, even in a derived form with scrypt/pbkdf or other derivation methods. I'm exploring the idea of encrypting a random payload with AES ...
1
vote
1answer
131 views

Can I make fixed-length ciphertext with AES-256-GCM?

I have a question about AES-256-GCM encryption. Can I make a fixed-length encryption output? In my understanding, I cannot make a fixed-length ciphertext. To me, the fixed-length output is much more ...
2
votes
0answers
18 views

Does the size of data to be encrypted influence the security of Gmac?

In this link: Has GMAC mode a future outside GCM?, the last comment given by the user Demi, indicates that the larger the size of the text to be encrypted, the lower the security of the gmac. Why is ...
2
votes
1answer
78 views

Is it safe to generate GCM/GMAC intermediate tags?

I would like to use GCM/GMAC in next manner: abcd|Tag0|efgh|Tag1|ijkl|Tag2| ... |wxyz|TagN The nuance is each tag I gonna generate is not from its last block but ...
2
votes
2answers
140 views

Is this correct/incorrect password for file encryption scheme secure?

I'm writing an AES file encryption program, and I'd like to put in a way to tell whether or not the user has entered the correct password without decrypting the entire file and GCM telling me the tag ...
1
vote
0answers
154 views

AES-GCM - what are “Payload Length” and “AAD Length”

For the AES-GCM mode within many cryptomodules, their FIPS-validation certificates list the options: Payload Length: 504, 512, 1016, 1024 AAD Length: 0, 504, 512, 1016, 1024 For example in OpenSSL, "...
5
votes
2answers
582 views

What are the popular modes-of-operation (AES-GCM, AES-SIV, AES-GCM-SIV, etc.) geared for?

I'm interested in developing software capable of encrypting personal files (which will ultimately be backed up to the cloud) and have been doing my best to follow best practices. There are many forms ...
0
votes
1answer
209 views

How does AEAD guarantee authenticated encryption and plain AES does not?

This is a follow up to my earlier question. This is more out of curiosity in how AEAD (like CCM or GCM) works compared to encryption in other modes (like CBC or ECB). Suppose you have AES-256-CBC ...
2
votes
1answer
40 views

Security implications of not concatenating a 1 to the IV when using GCM

When using GCM, The padding string $0^{31}||1$ is appended to the IV. I know that this is done to avoid the repetition of $E_K(0^n)$ which is used as key for the GHash. But what would be the security ...
3
votes
3answers
7k views

How to encrypt files using AES256-GCM cipher under Linux? [closed]

I'm struggling to implement AES256-GCM on a Linux machine to encrypt files outgoing to another party. We're usually exchanging files using PKI, but this particular party insists on AES256-GCM and ...
1
vote
1answer
147 views

How does AES-GCM produce different ciphertexts, and how can the algorithm decrypt the values if they're random?

The title explains it. How does AES-GCM (or other modes for that matter) generate random ciphertexts per execution, and how does the algorithm decrypt a random value since the sender randomizes the ...
3
votes
1answer
370 views

Why can't AES-GCM be used in IKEv1 phase 1?

I was configuring a VPN on a firewall (fortigate) and realized that I could use AES-GCM for encryption in the IKEv1 phase 2 but not in the phase 1 and I was wondering why knowing that in IKEv2 we ...
4
votes
1answer
330 views

Why doesn't GMAC/GCM encrypt its authentication tag?

As most know, a duplicate nonce with GMAC/GCM allows key recovery attacks against GMAC itself and thus the ability to forge messages. This is because GMAC computes GHASH and then just XORs this with ...
5
votes
1answer
283 views

AEAD (for AES128-GCM): is it necessary to add a zero-length AAD?

In an implementation of AEAD_AES_128_GCM, if the AAD is defined as a "zero-length octet sequence", is it necessary to call the encryption code that adds an AAD at all? In particular, does an OpenSSL/...
2
votes
1answer
305 views

Using an AES-256-GCM key as a salt to SHA-256

Assume 256 bit keys are randomly generated and data is encrypted using AES-GCM-256 prior to being sent to a server. The goal is to enable the server to determine uniqueness of data it receives ...
5
votes
3answers
662 views

Nonce-misuse-resistance scheme applied after the fact to AES-GCM for defense in depth?

This is a follow-up to a previous question about encrypting IV/MAC results from AEAD ciphers. I have a system I'm working on that needs to use standard (NIST/FIPS) cryptography, at least for its ...
2
votes
2answers
300 views

Any benefit to encrypting IV and MAC in a mode like AES-GCM or ChaChaPoly?

Would there be any benefit to symmetrically encrypting the IV and MAC in an AEAD mode of operation? More specifically would this prevent someone from exploiting the accidental use of a duplicate IV ...
4
votes
1answer
2k views

Is the Java function AES/CBC/PKCS5Padding vulnerable to padding oracle?

I have an application that stores data on the devices. Currently AES/CBC/PKCS5Padding from javax.crypto.Cipher(see reference) is ...

1
2 3 4 5 6