Questions tagged [gcm]

The Galois Counter Mode, an authenticated encryption mode of operation for a block cipher.

Filter by
Sorted by
Tagged with
0
votes
1answer
44 views

AES-GCM can IV be stored alongside in DB?

I'm trying to encrypt and store strings in PHP as per example #1 on the PHP openssl_encrypt documentation. ...
1
vote
0answers
63 views

How can I decrypt AES-256 GCM with key with a IV that is missing?

I want to decrypt a file that has been encrypted using AES-256 in GCM mode in libressl. I have the key but I don't have the IV, is there any way I can still decrypt?
2
votes
1answer
42 views

Is it possible to do partial message authentication?

I want to authenticate part of a message, not all of it, while creating the MAC over the entire message. Let's say I create a 16B MAC over one hundred message blocks that are 64B each. Then I send one ...
0
votes
0answers
25 views

Security of generating one long hash and using half as a secret key and half as a “public” hash vs generating two hash values?

My question is what would be more secure, generating 2 hashes (one key and one hash) with the same password and two different salt values, or generating one long hash with a single salt, taking the ...
0
votes
0answers
30 views

Where to get AES GCM NIST-like test cases

I'm implementing AES GCM 256 bit at the moment. Now I'm finished with copying the content of the standard as a program and now have to make it actually work. With the test cases in the official NIST ...
0
votes
1answer
58 views

Authentication in Lattice PQC candidates

I am looking into Authentication in lattice cryptography. Specifically in the NIST KEM finalists. I was specifically looking to see if there was a GCM (Galois counter mode) equivalence in the lattice ...
14
votes
5answers
2k views

AES GCM : is it acceptable to return the wrong plaintext if the tag is incorrect?

Let's start by saying I'm no cryptography expert, I'm just a developer, so feel free to correct me (using words, not downvotes) if what I'm saying is non-sense. Context: I'm doing some crypto as a ...
0
votes
2answers
41 views

what is auth data in AES-GCM

I am trying to understand AES-GCM and I do not understand what I should transmit to Auth Data during encryption. What kind of data is that?
0
votes
1answer
235 views

AES/GCM/PKCS5Padding giving issues while AES/CBC/PKCS5Padding works fine for my use case

I have a requirement to read-encypt-save plus its reverse i.e. read-decypt-save files through chunk/block mechanism (single operation not feasible because of huge(GBs) file sizes). So essentially the ...
0
votes
0answers
19 views

Why does AES_GCM sometimes has a SHA for integrity? [duplicate]

For example the following suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 From what I understand the SHA384 at the end is used to authenticate the message, which is exactly what MAC does, and the mode ...
4
votes
1answer
113 views

How does GHASH used in GCM behave as a universal hashing function?

As per my understanding, a Universal Hash Function isn't a cryptographic hash function & it's output isn't uniformly distributed. However, this is still secure because it's actually a family of ...
3
votes
1answer
66 views

What are the implications of allowing a zero-length GCM nonce?

NIST SP800-38D section 5.2.1.1 is clear that empty nonces are not allowed with GCM, but without explaining the reasoning. My assumption was this is simply because the probability of error (encrypting ...
2
votes
1answer
129 views

What is the overhead of GCM? And how are GCM tags signed by RSA/PKI?

I'm mainly trying to wrap my head around the pipeline of encryption, hashing and signing. I've read over this question, describing the overhead of GCM, which I understand to be configurable for space-...
0
votes
0answers
66 views

Is this a reasonable design for encrypting records in a key/value database?

A while back I designed a protocol for en encrypted key/value service. My main goal was to minimize the value of a breached database by using cryptographic algorithms where a brute-force cracking ...
1
vote
1answer
82 views

Is a stream cipher and a (cryptographically secure) PRNG nearly the same thing?

If I let the authentification tag aside (which is important), encrypting with AES-GCM and a fixed key and nonce: ...
3
votes
2answers
339 views

Does it make any sense to sign a GCM authentication tag with RSA?

To achieve double insurance for authentication, can we sign the GCM final tag with using RSA? with RSA, no one is able to create his own tag since the private key is not known. However, according to ...
5
votes
1answer
212 views

How to securely encrypt/decrypt data with a maximum chunk size?

I am aware of the different modes so that a "raw" block cipher such as AES (ECB) can be used to encrypt more than a single block of data (CBC, OFB, CTR, etc) and modes such as AES-GCM which ...
3
votes
3answers
344 views

Designing a secure UDP-based communication protocol

SUMMARY UPDATE: I have changed the title of this question from "Using an encrypted packet counter as a counter value in AES-CTR" to "Designing a secure UDP-based communication protocol&...
4
votes
0answers
182 views

Is AES-GCM-SIV with fixed IV deterministic authenticated encryption?

Is there any functional or strong security difference beyond speed between AES-GCM-SIV with implicit fixed public IV and no additional data AES-CTR (or AES-OFB) with 128-bit IV computed per HMAC-SHA-...
1
vote
1answer
231 views

Is it dangerous to encrypt lots of small files with the same key?

I want to encrypt 1000s of old files on old hard drives before uploading them to the cloud. I'm planning to use AES-GCM with only one or a few keys. (I'm using Apple's CryptoKit library which provides ...
3
votes
1answer
108 views

AES-GCM ciphertext that deciphers under two keys

How can we exhibit an AES-GCM ciphertext, including IV and 128-bit authentication tag, and distinct keys $K_0$ and $K_1$, so that decryption succeeds for both keys? What degree of control do we have ...
2
votes
3answers
474 views

Can AES GCM mode detect an incorrect key and refuse to decrypt?

I understand that AES in GCM mode produces an authentication tag that is used to ensure that a tampered with cipher text is not decrypted. However, if I pass the wrong key will AES in GCM mode detect ...
0
votes
1answer
217 views

Is XTS always better than GCM?

XTS is suitable for disk encryption while GCM doesn't. Both require the same number of block encryption calls. Both are parallel in encryption and decryption. XTS is actually even faster in openssl ...
2
votes
1answer
39 views

Best suitable column type for openssl $tag,$iv,$key,$encrypted?

Which column type is best for storing $tag, $iv, $key, $encryptedData generated by openssl_encryption, and in which format I should save these values? I am using &...
1
vote
1answer
52 views

Number message limits of Galois/Counter Mode (GCM) per key

In https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf page 27, it is said that ...the total number of blocks of plaintext and AAD that are protected by invocations of the ...
3
votes
2answers
165 views

Extending AES-GCM initialization vector

We all know that applications of crypto primitives like to not think about the management of nonces, and initialization vectors and often prefer to just set them to random values. This sometimes leads ...
2
votes
2answers
943 views

AES-GCM: Verification before Decryption

I am looking at ChaCha20Poly1305 WolfSSL. It is noted that the ChaCha20Poly1305 AEAD construction has the property, that it only outputs the plaintext, if the verification of the MAC (Authentication ...
0
votes
0answers
24 views

Authenticating and encrypting data for an automated system

I wish to distribute a file from A to an automated system B. The requirements are: Contents are encrypted Contents are tamper proof Contents origin is verified To do this I have devised the ...
2
votes
1answer
210 views

The Security of AES-N-GCM

In the paper The Security and Performance of the GaloisCounter Mode(GCM) of Operation,it shows the AES GCM SECURITY in Corollary 1. there are no distinguishing attacks against AES-N-GCM that work ...
1
vote
1answer
58 views

Implications of Shor's algorithm on $F_{2^m}$ elliptic curves and GHASH

The security of elliptic curves depends on the difficulty of the discrete logarithm problem. Should Shor's Algorithm ever prove viable then elliptic curves would cease to offer any useful security ...
3
votes
1answer
91 views

GCM Construction of table M0

I am reading the paper on GCM The Galois/Counter Mode of Operation (GCM) . I have some doubts about the implementation of table M0 and R. When I have to multiply by the variable P it is ...
0
votes
1answer
81 views

GCM Create M tables and R

I am trying to optimize GCM multiplication. This PDF explains GCM: The Galois/Counter Mode of Operation (GCM) The algorithms are in section 4.1 In algorithm 3 I have to multiply table M [128] ...
0
votes
1answer
70 views

Does the authentification in GCM serve the same purpose as CRC32?

The purpose of the authentification is to ensure the data integrity. Let's just focus on the authentification part of the GCM which is using the Galois field multiplication to create an ...
3
votes
1answer
110 views

Is there an increased risk of nonce reuse when using GCM with a nonce more than 96 bits?

GCM is designed to use a 96-bit nonce, which can be generated either randomly or deterministically. If you use a nonce that isn't 96 bits then it is padded and hashed with GHASH to create a ...
1
vote
1answer
126 views

Safe way to derive IV from the DH shared keys for AES-GCM?

I am preparing to use AES-GCM to make a secure communication program. Here is the procedure DH key exchange to get shared keys SHA256(shared keys) Use AES-GCM to encrypt a message while the key only ...
0
votes
1answer
71 views

Does Camellia-GCM use Camellia-CTR to create GCM Hash?

I'm still confused when reading GnuTLS/Nettle implementation about Camellia-GCM.
1
vote
2answers
378 views

Can an AES-GCM be cracked if the key is known but the nonce isn't?

I'm kind of new in this field and I've been trying to learn it. I'm now facing an issue where I have a couple of packages encrypted with AES-128 GCM and I have the key that was used to encrypt these ...
5
votes
1answer
106 views

Line by line encrypted logging stored with iv/salt/iterations. How safe is it?

I'm building an encrypted logging application. Log entries are encrypted with AES-256-GCM, using password-derived keys with PBKDF2. The application must support log rotation, and I would like to make ...
0
votes
0answers
57 views

Can I use aes-gcm to authenticate a user based on his ability to decrypt a payload?

I'd like to authenticate my users without storing their password, even in a derived form with scrypt/pbkdf or other derivation methods. I'm exploring the idea of encrypting a random payload with AES ...
1
vote
1answer
142 views

Can I make fixed-length ciphertext with AES-256-GCM?

I have a question about AES-256-GCM encryption. Can I make a fixed-length encryption output? In my understanding, I cannot make a fixed-length ciphertext. To me, the fixed-length output is much more ...
2
votes
0answers
19 views

Does the size of data to be encrypted influence the security of Gmac?

In this link: Has GMAC mode a future outside GCM?, the last comment given by the user Demi, indicates that the larger the size of the text to be encrypted, the lower the security of the gmac. Why is ...
2
votes
1answer
79 views

Is it safe to generate GCM/GMAC intermediate tags?

I would like to use GCM/GMAC in next manner: abcd|Tag0|efgh|Tag1|ijkl|Tag2| ... |wxyz|TagN The nuance is each tag I gonna generate is not from its last block but ...
2
votes
2answers
157 views

Is this correct/incorrect password for file encryption scheme secure?

I'm writing an AES file encryption program, and I'd like to put in a way to tell whether or not the user has entered the correct password without decrypting the entire file and GCM telling me the tag ...
1
vote
0answers
173 views

AES-GCM - what are “Payload Length” and “AAD Length”

For the AES-GCM mode within many cryptomodules, their FIPS-validation certificates list the options: Payload Length: 504, 512, 1016, 1024 AAD Length: 0, 504, 512, 1016, 1024 For example in OpenSSL, "...
5
votes
2answers
690 views

What are the popular modes-of-operation (AES-GCM, AES-SIV, AES-GCM-SIV, etc.) geared for?

I'm interested in developing software capable of encrypting personal files (which will ultimately be backed up to the cloud) and have been doing my best to follow best practices. There are many forms ...
0
votes
1answer
231 views

How does AEAD guarantee authenticated encryption and plain AES does not?

This is a follow up to my earlier question. This is more out of curiosity in how AEAD (like CCM or GCM) works compared to encryption in other modes (like CBC or ECB). Suppose you have AES-256-CBC ...
2
votes
1answer
42 views

Security implications of not concatenating a 1 to the IV when using GCM

When using GCM, The padding string $0^{31}||1$ is appended to the IV. I know that this is done to avoid the repetition of $E_K(0^n)$ which is used as key for the GHash. But what would be the security ...
4
votes
3answers
8k views

How to encrypt files using AES256-GCM cipher under Linux? [closed]

I'm struggling to implement AES256-GCM on a Linux machine to encrypt files outgoing to another party. We're usually exchanging files using PKI, but this particular party insists on AES256-GCM and ...
1
vote
1answer
173 views

How does AES-GCM produce different ciphertexts, and how can the algorithm decrypt the values if they're random?

The title explains it. How does AES-GCM (or other modes for that matter) generate random ciphertexts per execution, and how does the algorithm decrypt a random value since the sender randomizes the ...
3
votes
1answer
434 views

Why can't AES-GCM be used in IKEv1 phase 1?

I was configuring a VPN on a firewall (fortigate) and realized that I could use AES-GCM for encryption in the IKEv1 phase 2 but not in the phase 1 and I was wondering why knowing that in IKEv2 we ...

1
2 3 4 5 6