Questions tagged [gcm]

The Galois Counter Mode, an authenticated encryption mode of operation for a block cipher.

Filter by
Sorted by
Tagged with
1 vote
2 answers
44 views

Why does AES-GCM means No MAC key, instead of MAC key what they are going to use?

From RFC 5246, section 6.2.3.3: AEAD Ciphers: AEAD ciphers take as input a single key, a nonce, a plaintext, and "additional data" to be included in the authentication check, as described in ...
user avatar
  • 49
-1 votes
0 answers
31 views

I am not able understand how the AES-GCM implementation (pseudo code) in TLS1.2 [closed]

AEAD ciphers take as input a single key, a nonce, a plaintext, and "additional data" to be included in the authentication check, as described in Section 2.1 of [AEAD]. The key is either the ...
user avatar
  • 49
1 vote
1 answer
71 views

Does deriving a key from a master key and then encrypting with AES-GCM increase the lifetime of the master key?

Suppose that we have a symmetric 256-bit master key, and we want to encrypt using AES-GCM with random IVs. I understand that with random IVs, the lifetime of the master key is 2^32 in order to conform ...
user avatar
2 votes
1 answer
49 views

Validating AES GCM authentication tag between two different implementations

I'm a bit confused on how to validate the authentication tag between two different AES GCM implementations. One implementation (on my part) is in Java. The other, I don't know. In my implementation, ...
user avatar
1 vote
1 answer
69 views

Multiple Encryption Using GCM For Multi-Key Security

Multiple Encryption For Multi-Key Security I have a hypothetical question about multiple encryption after reading Matthew Green’s blog on multiple encryption. For those who are familiar with GCM…I ...
user avatar
  • 11
1 vote
1 answer
183 views

How is TLS 1.3 application data encrypted with AES-GCM sent 'over the wire'?

I've been trying to manually decrypt some TLS 1.3 traffic for educational reasons, and have stumbled across a roadblock. So far, I've been able to complete most of the key schedule, including deriving ...
user avatar
  • 131
1 vote
1 answer
100 views

Performance of AES CTR + HMAC SHA1

I'm doing a performance test on AES with CTR mode and HMAC SHA1 for message authentication and found the openssl speed tool for that. I run multiple tests with <...
user avatar
  • 15
0 votes
1 answer
77 views

CTR HMAC SHA1 vs GCM Key management

The protocol SRTP uses by default AES in CTR mode with HMAC-SHA1. For my thesis I want to research if GCM would be a better option. Therefore I read following discussion. There the answer was that GCM ...
user avatar
  • 15
1 vote
1 answer
76 views

Understanding the algebra behind GCM's security

I would like to understand the algebra behind GCM's security. Before I ask my questions, let me state my understanding of the math behind GCM. If correct, my questions are at the end; if incorrect, ...
user avatar
4 votes
1 answer
217 views

Java: SecureRandom.getInstanceStrong() vs new SecureRandom()

Given SecureRandom class is considered suitable for use in cryptography, I consider new SecureRandom() to be secure (funny term, ...
user avatar
0 votes
1 answer
84 views

How to produce Auth Data and tag in GCM? Does MAC appended CTR mode encrypted text weaker than GCM?

In https://en.wikipedia.org/wiki/Galois/Counter_Mode, there's a diagram which tells us how GCM works in general. I have watched computerphile video on how ECB,CBC and CTR mode works and able to ...
user avatar
  • 91
4 votes
1 answer
169 views

Is GCM with zero-length AAD less secure?

In a previous question, it was made clear that in the case of GCM, there is no distinction between "no AAD" and "zero-length AAD". Since I have noticed "zero-length AAD" ...
user avatar
  • 161
4 votes
1 answer
151 views

Lack of response to CAESAR competition

Why is there so little response (e.g. implementation in crypto libraries, programs...) after the end of the CAESAR competition? As far as I can see, there is no shift from AES-GCM to any of the CAESAR ...
user avatar
  • 853
0 votes
1 answer
70 views

Security level of Poly1305 and GMAC

The Libsodium docs list the AEAD forgery limits for ChaCha20Poly1305 and AES-GCM which seems like a < 128-bit security level but says that it's not a practical concern. I've seen other people say ...
user avatar
2 votes
1 answer
73 views

How does Authentication-Key Recovery for GCM work?

In his Paper "Authentication weaknesses in GCM" Ferguson describes, how some bits of the error polynomial can be set to zero, thereby increasing significantly the chance of a forgery. Q: ...
user avatar
  • 1,447
3 votes
1 answer
106 views

Factorization of polynomial in GF(2^128) used in GCM

It is widely known, that using a GCM nonce twice or even more often can be used to disclose the authentication key H. I understand, why this is theoretically possible. However, I have no feeling about ...
user avatar
  • 1,447
1 vote
1 answer
221 views

Why using same nonce (IV) twice voids confidentiality of plain text or even key?

I understand roughly (without details of GF algebra) the scheme of GCS/GMAC: IV is to be put into Counter-0, so initializing counters. It is known, that using a IV twice can not only reveal the plain ...
user avatar
  • 1,447
0 votes
1 answer
389 views

AES-GCM can IV be stored alongside in DB?

I'm trying to encrypt and store strings in PHP as per example #1 on the PHP openssl_encrypt documentation. ...
user avatar
  • 103
1 vote
0 answers
328 views

How can I decrypt AES-256 GCM with key with a IV that is missing?

I want to decrypt a file that has been encrypted using AES-256 in GCM mode in libressl. I have the key but I don't have the IV, is there any way I can still decrypt?
user avatar
2 votes
1 answer
51 views

Is it possible to do partial message authentication?

I want to authenticate part of a message, not all of it, while creating the MAC over the entire message. Let's say I create a 16B MAC over one hundred message blocks that are 64B each. Then I send one ...
user avatar
0 votes
0 answers
162 views

Where to get AES GCM NIST-like test cases

I'm implementing AES GCM 256 bit at the moment. Now I'm finished with copying the content of the standard as a program and now have to make it actually work. With the test cases in the official NIST ...
user avatar
0 votes
1 answer
62 views

Authentication in Lattice PQC candidates

I am looking into Authentication in lattice cryptography. Specifically in the NIST KEM finalists. I was specifically looking to see if there was a GCM (Galois counter mode) equivalence in the lattice ...
user avatar
15 votes
5 answers
2k views

AES GCM : is it acceptable to return the wrong plaintext if the tag is incorrect?

Let's start by saying I'm no cryptography expert, I'm just a developer, so feel free to correct me (using words, not downvotes) if what I'm saying is non-sense. Context: I'm doing some crypto as a ...
user avatar
  • 253
0 votes
2 answers
259 views

what is auth data in AES-GCM

I am trying to understand AES-GCM and I do not understand what I should transmit to Auth Data during encryption. What kind of data is that?
user avatar
0 votes
2 answers
2k views

AES/GCM/PKCS5Padding giving issues while AES/CBC/PKCS5Padding works fine for my use case

I have a requirement to read-encypt-save plus its reverse i.e. read-decypt-save files through chunk/block mechanism (single operation not feasible because of huge(GBs) file sizes). So essentially the ...
user avatar
0 votes
0 answers
21 views

Why does AES_GCM sometimes has a SHA for integrity? [duplicate]

For example the following suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 From what I understand the SHA384 at the end is used to authenticate the message, which is exactly what MAC does, and the mode ...
user avatar
  • 11
5 votes
1 answer
211 views

How does GHASH used in GCM behave as a universal hashing function?

As per my understanding, a Universal Hash Function isn't a cryptographic hash function & it's output isn't uniformly distributed. However, this is still secure because it's actually a family of ...
user avatar
  • 1,637
3 votes
1 answer
81 views

What are the implications of allowing a zero-length GCM nonce?

NIST SP800-38D section 5.2.1.1 is clear that empty nonces are not allowed with GCM, but without explaining the reasoning. My assumption was this is simply because the probability of error (encrypting ...
user avatar
  • 1,664
2 votes
1 answer
397 views

What is the overhead of GCM? And how are GCM tags signed by RSA/PKI?

I'm mainly trying to wrap my head around the pipeline of encryption, hashing and signing. I've read over this question, describing the overhead of GCM, which I understand to be configurable for space-...
user avatar
0 votes
0 answers
78 views

Is this a reasonable design for encrypting records in a key/value database?

A while back I designed a protocol for en encrypted key/value service. My main goal was to minimize the value of a breached database by using cryptographic algorithms where a brute-force cracking ...
user avatar
  • 101
3 votes
1 answer
202 views

Is a stream cipher and a (cryptographically secure) PRNG nearly the same thing?

If I let the authentification tag aside (which is important), encrypting with AES-GCM and a fixed key and nonce: ...
user avatar
  • 481
3 votes
2 answers
443 views

Does it make any sense to sign a GCM authentication tag with RSA?

To achieve double insurance for authentication, can we sign the GCM final tag with using RSA? with RSA, no one is able to create his own tag since the private key is not known. However, according to ...
user avatar
  • 61
7 votes
1 answer
448 views

How to securely encrypt/decrypt data with a maximum chunk size?

I am aware of the different modes so that a "raw" block cipher such as AES (ECB) can be used to encrypt more than a single block of data (CBC, OFB, CTR, etc) and modes such as AES-GCM which ...
user avatar
3 votes
3 answers
621 views

Designing a secure UDP-based communication protocol

SUMMARY UPDATE: I have changed the title of this question from "Using an encrypted packet counter as a counter value in AES-CTR" to "Designing a secure UDP-based communication protocol&...
user avatar
4 votes
0 answers
344 views

Is AES-GCM-SIV with fixed IV deterministic authenticated encryption?

Is there any functional or strong security difference beyond speed between AES-GCM-SIV with implicit fixed public IV and no additional data AES-CTR (or AES-OFB) with 128-bit IV computed per HMAC-SHA-...
user avatar
  • 124k
2 votes
1 answer
430 views

Is it dangerous to encrypt lots of small files with the same key?

I want to encrypt 1000s of old files on old hard drives before uploading them to the cloud. I'm planning to use AES-GCM with only one or a few keys. (I'm using Apple's CryptoKit library which provides ...
user avatar
  • 123
3 votes
1 answer
174 views

AES-GCM ciphertext that deciphers under two keys

How can we exhibit an AES-GCM ciphertext, including IV and 128-bit authentication tag, and distinct keys $K_0$ and $K_1$, so that decryption succeeds for both keys? What degree of control do we have ...
user avatar
  • 124k
2 votes
3 answers
1k views

Can AES GCM mode detect an incorrect key and refuse to decrypt?

I understand that AES in GCM mode produces an authentication tag that is used to ensure that a tampered with cipher text is not decrypted. However, if I pass the wrong key will AES in GCM mode detect ...
user avatar
  • 461
0 votes
1 answer
761 views

Is XTS always better than GCM?

XTS is suitable for disk encryption while GCM doesn't. Both require the same number of block encryption calls. Both are parallel in encryption and decryption. XTS is actually even faster in openssl ...
user avatar
  • 113
2 votes
1 answer
80 views

Best suitable column type for openssl $tag,$iv,$key,$encrypted?

Which column type is best for storing $tag, $iv, $key, $encryptedData generated by openssl_encryption, and in which format I should save these values? I am using &...
user avatar
1 vote
1 answer
99 views

Number message limits of Galois/Counter Mode (GCM) per key

In https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf page 27, it is said that ...the total number of blocks of plaintext and AAD that are protected by invocations of the ...
user avatar
  • 73
3 votes
2 answers
247 views

Extending AES-GCM initialization vector

We all know that applications of crypto primitives like to not think about the management of nonces, and initialization vectors and often prefer to just set them to random values. This sometimes leads ...
user avatar
  • 1,105
2 votes
2 answers
2k views

AES-GCM: Verification before Decryption

I am looking at ChaCha20Poly1305 WolfSSL. It is noted that the ChaCha20Poly1305 AEAD construction has the property, that it only outputs the plaintext, if the verification of the MAC (Authentication ...
user avatar
  • 121
0 votes
0 answers
26 views

Authenticating and encrypting data for an automated system

I wish to distribute a file from A to an automated system B. The requirements are: Contents are encrypted Contents are tamper proof Contents origin is verified To do this I have devised the ...
user avatar
  • 1
2 votes
1 answer
228 views

The Security of AES-N-GCM

In the paper The Security and Performance of the GaloisCounter Mode(GCM) of Operation,it shows the AES GCM SECURITY in Corollary 1. there are no distinguishing attacks against AES-N-GCM that work ...
user avatar
  • 21
1 vote
1 answer
97 views

Implications of Shor's algorithm on $F_{2^m}$ elliptic curves and GHASH

The security of elliptic curves depends on the difficulty of the discrete logarithm problem. Should Shor's Algorithm ever prove viable then elliptic curves would cease to offer any useful security ...
user avatar
  • 2,703
3 votes
1 answer
132 views

GCM Construction of table M0

I am reading the paper on GCM The Galois/Counter Mode of Operation (GCM) . I have some doubts about the implementation of table M0 and R. When I have to multiply by the variable P it is ...
user avatar
  • 33
0 votes
1 answer
104 views

GCM Create M tables and R

I am trying to optimize GCM multiplication. This PDF explains GCM: The Galois/Counter Mode of Operation (GCM) The algorithms are in section 4.1 In algorithm 3 I have to multiply table M [128] ...
user avatar
  • 1
0 votes
1 answer
110 views

Does the authentification in GCM serve the same purpose as CRC32?

The purpose of the authentification is to ensure the data integrity. Let's just focus on the authentification part of the GCM which is using the Galois field multiplication to create an ...
user avatar
  • 61
3 votes
1 answer
205 views

Is there an increased risk of nonce reuse when using GCM with a nonce more than 96 bits?

GCM is designed to use a 96-bit nonce, which can be generated either randomly or deterministically. If you use a nonce that isn't 96 bits then it is padded and hashed with GHASH to create a ...
user avatar

1
2 3 4 5 6