Questions tagged [gcm]

The Galois Counter Mode, an authenticated encryption mode of operation for a block cipher.

Filter by
Sorted by
Tagged with
1 vote
1 answer
101 views

Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit, why Not 2^39 [duplicate]

While examining the initial GCM specification by McGrew and Viega in 2005, it appears that the formation of the 128-bit Initialization Vector by combining a 96-bit nonce and a 32-bit unsigned wrapping ...
xyz's user avatar
  • 21
0 votes
0 answers
104 views

AES-GCM with a fixed IV but a random "wrapped" key

It is well-known that AES-GCM requires the IV to be unique for each message that is encrypted with the same key. If the IV ever repeats, with the same key, then AES-GCM fails catastrophically. Now, ...
pogoya9172's user avatar
4 votes
2 answers
332 views

Key commitment in GCM (or AEAD in general)

Many of the presentations at The Third NIST Workshop on Block Cipher Modes of Operation 2023 complain about the lack of key commitment in AES-GCM. But isn't that one application of "associated ...
yoyo's user avatar
  • 367
0 votes
0 answers
83 views

Is it possible to uncover the plaintext if IV is used twice but the key is different?

I am currently working on a cryptography challenge. The program uses AES-GCM to encrypt and decrypt strings. Let's say I have the following: IV which is reused only 1 cipher text authentication tag ...
fdfdfd's user avatar
  • 101
0 votes
0 answers
30 views

Encrypted Alert21- Error code 214

I am working on TLS 1.2 Cipher TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, After send the application data server throws an error message ...
Ahamed Fayaz.'s user avatar
1 vote
1 answer
65 views

Newbie question about AES-GCM and IV

Imagine a channel where the initial secret for deriving of the actual key is established with ECDH. First, that shared secret is used to derive a temporary key with some default parameters (salt, ...
Kote Isaev's user avatar
1 vote
1 answer
49 views

DTLS 1.2 Cipher Suites With AES-GCM – What data (if any) is passed to the AES-GCM cipher as the Additional Authentication Data?

It is DTLS 1.2 version question of this question. I know from 4.1.2.4. of RFC 5246 (DTLS 1.2) AEAD Ciphers can be used in DTLS 1.2 exactly the same with TLS 1.2. In TLS 1.2 AAD = seq_num + ...
Jounghoo Lee's user avatar
1 vote
1 answer
226 views

How does AES-GCM and AES-CCM provide authenticity?

My lecture notes state that of the AES operating modes ECB, CBC, CTR, CCM (CTR+CBC MAC) and GCM, only CCM and GCM provide authenticity. In CCM, as I understand it, the authenticity lies in the MAC, i....
user946822's user avatar
3 votes
1 answer
108 views

What kind of hashing is GF multiplication in GCM cipher mode and GMAC?

In GCM, GMAC, the additional associated data (AAD) (as well as outputs of subsequent blocks) is multiplied by a polynomial H in GF(2^128). This appears to be doing some secure hashing. Is that what's ...
zzazzles's user avatar
  • 117
1 vote
2 answers
679 views

AES-GCM and tag length

Due to protocol limitations, I can put in 24 bytes of data only for tx (excluding headers), if I use AES_GCM for encrypting my data, I understand I don't need to worry about padding. For instance, if ...
EmbeddedEnthusiast's user avatar
2 votes
1 answer
316 views

Is it possible to reverse GHASH from GCM?

How can I create a "reverse" GHASH algorithm for GCM that allows me to compute an input value that generates a specific chosen output, given that I know the authentication key H? If this is ...
sWong's user avatar
  • 29
4 votes
2 answers
2k views

OpenSSL AES-GCM says 'bad decrypt', other block modes work fine?

If I do a simple encrypt and decrypt test like so: ...
RocketNuts's user avatar
  • 1,397
1 vote
0 answers
1k views

BAD Record MAC error from the server [closed]

I am working on ssl client because of some server update I was enabling the cipher TLS_DHE_RSA_WITH_AES_128_GCM_SHA256. While handshake with server I was facing Bad Record MAC Alert message from the ...
Ahamed Fayaz.'s user avatar
3 votes
2 answers
382 views

Why the polynomial of GCM is primitive?

I'm interested on the polynomial used in GCM-mode : $X^{128}+X^7+X^2+X+1$ This polynomial is Primitive (in $\mathbb{F}_2$). What is the interest of choosing a primitive polynomial and not a simple ...
Ievgeni's user avatar
  • 2,565
0 votes
2 answers
891 views

Why GCM is used more often than CTR?

I've seen (on Wikipedia) in the more recent version of TLS, the Counter-mode was not used. But the Galois-Counter-mode was used? What is the advantage to use the GCM instead of using the Counter-mode?
Ievgeni's user avatar
  • 2,565
5 votes
3 answers
874 views

Is 'authenticated' in AEAD actually authentication? Or is it message integrity?

Despite working with AES-GCM and other AEAD algos for a few years, I've struggled with the concept of 'authenticated' in the term 'AEAD'. In my own experience (of Unix, PKI and blockchain) ...
mikemaccana's user avatar
1 vote
1 answer
186 views

Is it normal that cypertext size can be smaller than IV when using AES-256-GCM?

I noticed that when using AES-256-CBC with a 128-bit IV, the ciphertext is always at least 16 bytes long (size of IV). I also noticed that when using AES-256-GCM with a 96-bit IV, the ciphertext size ...
sunknudsen's user avatar
2 votes
0 answers
64 views

Secure option for (hybrid) encryption of a secret key using JWE

I want to encrypt a private key $sk$ (it's actually an RSA private key in PKCS#8 format) with another person's (and/or my) public key $pk_A$ for secure storage. With JWE, it is possible to use hybrid ...
bertrandrussellsghost's user avatar
8 votes
1 answer
1k views

Would an encryption-only block cipher be useful at all?

I recently implemented AES block cipher, encryption side only, to be used in QUIC parsing (QUIC uses GCM mode). There are other modes than GCM that use only encryption: for example CTR, OFB, and CFB. ...
juhist's user avatar
  • 1,247
1 vote
1 answer
69 views

How does a GMAC in GCM not nullify the utility of a seekable decrypt-able stream

I have been looking at the Galois/Counter Mode (GCM) for stream encryption. I understand the idea that it's a stream cipher and so it can be encrypted one bit at a time by XORing with the key stream ...
Grub's user avatar
  • 113
1 vote
2 answers
736 views

Why does AES-GCM means No MAC key, instead of MAC key what they are going to use?

From RFC 5246, section 6.2.3.3: AEAD Ciphers: AEAD ciphers take as input a single key, a nonce, a plaintext, and "additional data" to be included in the authentication check, as described in ...
prasad's user avatar
  • 49
1 vote
1 answer
318 views

Does deriving a key from a master key and then encrypting with AES-GCM increase the lifetime of the master key?

Suppose that we have a symmetric 256-bit master key, and we want to encrypt using AES-GCM with random IVs. I understand that with random IVs, the lifetime of the master key is 2^32 in order to conform ...
user13129201's user avatar
2 votes
1 answer
2k views

Validating AES GCM authentication tag between two different implementations

I'm a bit confused on how to validate the authentication tag between two different AES GCM implementations. One implementation (on my part) is in Java. The other, I don't know. In my implementation, ...
newiatester's user avatar
1 vote
1 answer
234 views

Multiple Encryption Using GCM For Multi-Key Security

Multiple Encryption For Multi-Key Security I have a hypothetical question about multiple encryption after reading Matthew Green’s blog on multiple encryption. For those who are familiar with GCM…I ...
JeffT's user avatar
  • 11
1 vote
1 answer
822 views

How is TLS 1.3 application data encrypted with AES-GCM sent 'over the wire'?

I've been trying to manually decrypt some TLS 1.3 traffic for educational reasons, and have stumbled across a roadblock. So far, I've been able to complete most of the key schedule, including deriving ...
adrian's user avatar
  • 141
1 vote
1 answer
421 views

Performance of AES CTR + HMAC SHA1

I'm doing a performance test on AES with CTR mode and HMAC SHA1 for message authentication and found the openssl speed tool for that. I run multiple tests with <...
Soteri's user avatar
  • 115
0 votes
1 answer
169 views

CTR HMAC SHA1 vs GCM Key management

The protocol SRTP uses by default AES in CTR mode with HMAC-SHA1. For my thesis I want to research if GCM would be a better option. Therefore I read following discussion. There the answer was that GCM ...
Soteri's user avatar
  • 115
1 vote
1 answer
105 views

Understanding the algebra behind GCM's security

I would like to understand the algebra behind GCM's security. Before I ask my questions, let me state my understanding of the math behind GCM. If correct, my questions are at the end; if incorrect, ...
SRobertJames's user avatar
4 votes
1 answer
924 views

Java: SecureRandom.getInstanceStrong() vs new SecureRandom()

Given SecureRandom class is considered suitable for use in cryptography, I consider new SecureRandom() to be secure (funny term, ...
automatictester's user avatar
0 votes
1 answer
235 views

How to produce Auth Data and tag in GCM? Does MAC appended CTR mode encrypted text weaker than GCM?

In https://en.wikipedia.org/wiki/Galois/Counter_Mode, there's a diagram which tells us how GCM works in general. I have watched computerphile video on how ECB,CBC and CTR mode works and able to ...
Hern's user avatar
  • 125
4 votes
1 answer
487 views

Is GCM with zero-length AAD less secure?

In a previous question, it was made clear that in the case of GCM, there is no distinction between "no AAD" and "zero-length AAD". Since I have noticed "zero-length AAD" ...
hlayhel's user avatar
  • 191
8 votes
2 answers
370 views

Lack of response to CAESAR competition

Why is there so little response (e.g. implementation in crypto libraries, programs...) after the end of the CAESAR competition? As far as I can see, there is no shift from AES-GCM to any of the CAESAR ...
BeloumiX's user avatar
  • 985
0 votes
1 answer
162 views

Security level of Poly1305 and GMAC

The Libsodium docs list the AEAD forgery limits for ChaCha20Poly1305 and AES-GCM which seems like a < 128-bit security level but says that it's not a practical concern. I've seen other people say ...
Malcolm's user avatar
2 votes
1 answer
119 views

How does Authentication-Key Recovery for GCM work?

In his Paper "Authentication weaknesses in GCM" Ferguson describes, how some bits of the error polynomial can be set to zero, thereby increasing significantly the chance of a forgery. Q: ...
MichaelW's user avatar
  • 1,477
3 votes
1 answer
134 views

Factorization of polynomial in GF(2^128) used in GCM

It is widely known, that using a GCM nonce twice or even more often can be used to disclose the authentication key H. I understand, why this is theoretically possible. However, I have no feeling about ...
MichaelW's user avatar
  • 1,477
1 vote
1 answer
324 views

Why using same nonce (IV) twice voids confidentiality of plain text or even key?

I understand roughly (without details of GF algebra) the scheme of GCS/GMAC: IV is to be put into Counter-0, so initializing counters. It is known, that using a IV twice can not only reveal the plain ...
MichaelW's user avatar
  • 1,477
0 votes
1 answer
1k views

AES-GCM can IV be stored alongside in DB?

I'm trying to encrypt and store strings in PHP as per example #1 on the PHP openssl_encrypt documentation. ...
waffl's user avatar
  • 103
1 vote
0 answers
804 views

How can I decrypt AES-256 GCM with key with a IV that is missing?

I want to decrypt a file that has been encrypted using AES-256 in GCM mode in libressl. I have the key but I don't have the IV, is there any way I can still decrypt?
Ova Fleming's user avatar
2 votes
1 answer
74 views

Is it possible to do partial message authentication?

I want to authenticate part of a message, not all of it, while creating the MAC over the entire message. Let's say I create a 16B MAC over one hundred message blocks that are 64B each. Then I send one ...
zubairXenomorph's user avatar
0 votes
0 answers
601 views

Where to get AES GCM NIST-like test cases

I'm implementing AES GCM 256 bit at the moment. Now I'm finished with copying the content of the standard as a program and now have to make it actually work. With the test cases in the official NIST ...
zvavybir's user avatar
  • 101
0 votes
1 answer
67 views

Authentication in Lattice PQC candidates

I am looking into Authentication in lattice cryptography. Specifically in the NIST KEM finalists. I was specifically looking to see if there was a GCM (Galois counter mode) equivalence in the lattice ...
Daftyler's user avatar
19 votes
5 answers
3k views

AES GCM : is it acceptable to return the wrong plaintext if the tag is incorrect?

Let's start by saying I'm no cryptography expert, I'm just a developer, so feel free to correct me (using words, not downvotes) if what I'm saying is non-sense. Context: I'm doing some crypto as a ...
ShellCode's user avatar
  • 293
1 vote
2 answers
1k views

what is auth data in AES-GCM

I am trying to understand AES-GCM and I do not understand what I should transmit to Auth Data during encryption. What kind of data is that?
MyNameIsBoby's user avatar
0 votes
2 answers
5k views

AES/GCM/PKCS5Padding giving issues while AES/CBC/PKCS5Padding works fine for my use case

I have a requirement to read-encypt-save plus its reverse i.e. read-decypt-save files through chunk/block mechanism (single operation not feasible because of huge(GBs) file sizes). So essentially the ...
nirmalsingh's user avatar
0 votes
0 answers
22 views

Why does AES_GCM sometimes has a SHA for integrity? [duplicate]

For example the following suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 From what I understand the SHA384 at the end is used to authenticate the message, which is exactly what MAC does, and the mode ...
macie's user avatar
  • 11
5 votes
1 answer
449 views

How does GHASH used in GCM behave as a universal hashing function?

As per my understanding, a Universal Hash Function isn't a cryptographic hash function & it's output isn't uniformly distributed. However, this is still secure because it's actually a family of ...
user93353's user avatar
  • 2,169
3 votes
1 answer
127 views

What are the implications of allowing a zero-length GCM nonce?

NIST SP800-38D section 5.2.1.1 is clear that empty nonces are not allowed with GCM, but without explaining the reasoning. My assumption was this is simply because the probability of error (encrypting ...
Jack Lloyd's user avatar
  • 1,704
2 votes
1 answer
1k views

What is the overhead of GCM? And how are GCM tags signed by RSA/PKI?

I'm mainly trying to wrap my head around the pipeline of encryption, hashing and signing. I've read over this question, describing the overhead of GCM, which I understand to be configurable for space-...
Inquisitive's user avatar
0 votes
0 answers
136 views

Is this a reasonable design for encrypting records in a key/value database?

A while back I designed a protocol for en encrypted key/value service. My main goal was to minimize the value of a breached database by using cryptographic algorithms where a brute-force cracking ...
theory's user avatar
  • 101
4 votes
1 answer
330 views

Is a stream cipher and a (cryptographically secure) PRNG nearly the same thing?

If I let the authentification tag aside (which is important), encrypting with AES-GCM and a fixed key and nonce: ...
Basj's user avatar
  • 543

1
2 3 4 5
7