Questions tagged [gcm]

The Galois Counter Mode, an authenticated encryption mode of operation for a block cipher.

0
votes
1answer
57 views

AES-GCM cipher - Nonce vs IV

I am using a Python library called PyCryptodome, which offers the following API for AES-GCM ciphers: https://pycryptodome.readthedocs.io/en/latest/src/cipher/aes.html As you see, IV is not ...
0
votes
1answer
46 views

Does GCM improve the strenght of weak passwords?

If I am encrypting a file with GCM/AES256 with a weak key (say a sha256), does the fact that it takes time to brute force a long message improve my security? Example: I use the sha256 of "ARainyDay" ...
1
vote
1answer
66 views

Protocol Design for IoT devices having PSK using AES-GCM

Handshake: 1) Client To Server: "AES-GCM(Client_random_128bit,client_iv,psk),client_id,tag,client_iv" 2) Server To Client: "AES-GCM(Server_random_128bit,client_iv++,psk),tag ...
8
votes
3answers
1k views

Can a zero nonce be safely used with AES-GCM if the key is random and never used again?

I could generate a random nonce and prepend it to the ciphertext, but storage space is at a premium and the only constraint AES-GCM has on the nonce (if I'm reading correctly) is that the same nonce ...
1
vote
1answer
117 views

What is the Risk of Rotating Keys

This may be a difficult question So, $C_1$ = AES-GCM($k_1$, nonce, message) where nonce = HMAC(key,message). $C_2$ = AES-CBC($k_2$, iv, $C_1$). Now, a security breach occurs. The adversary obtains ...
0
votes
0answers
80 views

Can I Achieve Deterministic Encryption Using AES-GCM with Nonce = HMAC [ message ]

I would like to implement a deterministic encryption scheme within .NET. From the following post it is established using AES-SIV mode is appropriate. As AES-SIV mode is not implemented within the ...
0
votes
0answers
22 views

Mixed HMAC / GMAC with fixed IV [duplicate]

I was just thinking about improving the performance of HMAC - what would be the issues in doing the following: Let $G_K(IV,M)$ be GMAC with a key $K$, for IV and message $M$. Let $H$ be a secure hash ...
4
votes
0answers
202 views

Why does the Signal protocol use AES/CBC instead of AES/GCM?

AES/GCM has obviously proved itself to be better than AES/CBC. Unless the key is re-used with the same initialization vector (see disadvantages of GCM). More information of its advantages against CBC ...
2
votes
1answer
101 views

Guessing the key in AES256-GCM? [duplicate]

I assume that my case is weird but I've the following information: IV: 0x263e or 0x3e26 Auth tag: 0x25 AES256-GCM encrypted payload: 0x4eec96df534ade4c013a AES256-GCM decrypted payload: ...
1
vote
1answer
69 views

AES-GCM cipher tag and IV size, while attempting to render encrypted ciphertext useless by removing them

I'm using AES in GCM mode of operation for encryption/decryption & authentication of segments of data in a file. The layout of each segment can be summerized by this diagram. Each segment is ...
0
votes
1answer
41 views

GCM optimisation using $M_0$ and $R$ tables - Calculation of $R$

I'm implementing GCM in C as a way to learn about it. In the paper titled as The Galois/Counter Mode of Operation (GCM) by McGrew and Viega on chapter 4.1, page 11, 12, they talk about the ...
0
votes
1answer
43 views

Using key derived using HKDF or NIST sp800-108 with AES-CCM/GCM

Is it safe to use keys derived using HKDF or NIST sp800-108 with AES-CCM/GCM ? The NIST SP800-108 and SP*00-56C spec says "To comply with this Recommendation, the derived keying material shall not be ...
2
votes
1answer
107 views

What should I use for consequent AES key derivation?

I am writing a small chat program to explore some methods and concepts in cryptography and currently I am using a shared AES key tunneled with RSA which upon further reading revealed many flaws both ...
2
votes
2answers
680 views

AES256 GCM IV guidelines

If I use for example AES256 (GCM), and my message is bigger than 256bit (breaked into smaller 256bit blocks for encryption), should the IV change every 256bit of the message?
4
votes
1answer
58 views

How to handle the extra 12451 elements in Sophie-Germain Counter Mode?

In Sophie-Germain Counter Mode (SGCM), the $GF(2^{128})$ field multiplication of Galois Counter Mode (GCM) is replaced with normal multiplication $\bmod 2^{128}+12451$. Because the block size is 128 ...
9
votes
1answer
248 views

how does BearSSL's GCM modular reduction work?

BearSSL (in src/hash/ghash_ctmul.c) seems to be doing a modular reduction that I don't completely understand. Here's the code: ...
0
votes
1answer
60 views

How can you determine how long the MAC for GCM must be?

I want to use AES-GCM to encrypt 7 Byte data chunks. A 16 Byte MAC seems like overkill to me and the library I'm using gives me the option to make the MAC smaller. ...
7
votes
0answers
131 views

GCM with reversed poly

These slides talk about how GCM can be sped up if one uses $x^{128}+x^{127}+x^{126}+x^{121}+1$ as the reduction polynomial instead of $x^{128}+x^7+x^2+x^1+1$. When one is doing that one needs to ...
1
vote
1answer
59 views

With AES-GCM, may I use multiple tags per key?

In my implementation of AES-GCM, the key might change only once per minute. However, I wish to calculate a new tag every 6us, to reduce latency (since you have to buffer up a GCM "packet" before ...
1
vote
2answers
80 views

Implementations of GCM with 64-bit cipher

The paper The Galois/Counter Mode of Operation (GCM) describes mainly the 128-bit case, for use with 128-bit block ciphers such as AES. AES-GCM test vectors are available from NIST. The paper also ...
1
vote
2answers
192 views

how does AES GCM in SSH work?

I was looking at RFC5647: AES Galois Counter Mode for the Secure Shell Transport Layer Protocol and had some questions about section 7.1 "IV and Counter Management". Here's that section: ...
5
votes
1answer
548 views

Why doesn't the GCM spec use a more efficient multiplication algorithm?

NIST SP 800-38D § 6.3 Multiplication Operation on Blocks describes a multiplication algorithm that, in my testing, appears to be a good amount slower then algorithm 2.40 (arbitrary reduction ...
1
vote
1answer
63 views

GHASH with a finite field multiplication algorithm in reverse order

NIST SP 800-38D § 6.4 GHASH Function describes the GHASH algorithm thusly: Prerequisites: block $H$, the hash subkey. Input: bit string $X$ such that len($X$) = $128m$ for some positive ...
0
votes
1answer
43 views

modular reduction algorithm over $F_{2^m}$ doesn't seem to work when order of polynomial being reduced is small

I was considering algorithm 2.40 (arbitrary reduction polynomials) in the Guide to Elliptic Curve Cryptography and... it doesn't appear to work when the order of the polynomial you're trying to ...
2
votes
1answer
32 views

Are Authenticated Encryption ciphersuites supported in legacy TLS versions older than TLS 1.2?

I have read in a paper that Authenticated Encryption (by this I mean those that support GCM mode or ChaCha20 ciphers) are not supported in versions older than TLS 1.2? I could not confirm this as ...
1
vote
1answer
62 views

Does re-transmission really reduce security?

I am using AES with GCM and a colleague told me "Repeating a VCC with the same key and a different message reduces the security of the key." He did not have any additional detail to offer. What he ...
1
vote
1answer
439 views

CBC related TLS cipher suites to be disabled in the server side

I understand the TLS cipher suites using CBC mode are susceptible to timing attacks. From that understanding it seems that the cipher suites using GCM (CTR-based) are safe to use considering they don'...
2
votes
1answer
79 views

GCM decryption and clear text processing

When using GCM mode decryption, is it necessary to wait for the decryption to complete, (and thus being able to see if the integrity of cipher text is OK) before beginning processing the clear text ...
1
vote
0answers
25 views

How is GCM Parallelizeable? [duplicate]

The Wikipedia article on GCM says GCM can take full advantage of parallel processing. I had thought GCM uses a random IV for the first block, then for the second ...
2
votes
1answer
54 views

What would be an adversary advantage in case of GCM authentication?

Philip Rogaway has written a formula for CCM mode where the adversary advantage is given as: $$adversary\_advantage \leq \frac{q_{dec}}{2^t} + \frac{\sigma^2}{2^b}$$ Can we use this formula to find ...
0
votes
1answer
415 views

AES-GCM GHASH calculation;

I'm trying to make an GHASH() function and need some clarification. Implementation is based on gcm-spec. Page 8 describes polynomial mult and page 27 has a "Test Case 2" which I use to verify result. ...
8
votes
1answer
102 views

GCM mode of operation with long-term keys

Cross-post: https://cstheory.stackexchange.com/q/41435/873 Regarding GCM, NIST specifies the following: The total number of invocations of the authenticated encryption function shall not exceed $2^...
1
vote
1answer
502 views

Which one is faster GCM AES-128 or Curve25519?

As I know the symmetric encryption algorithms are faster than asymmetric encryption algorithms. But when I test GCM AES-128 and Curve25519 encryption time, I find Curve25519 is faster than GCM AES-128....
1
vote
2answers
623 views

Is it safe to use a timestamp to build a nonce?

I'm writing an application, which can be used on multiple clients, and share data on a server. To make sure the data never leaves the clients unencrypted, the application should offer encryption with ...
2
votes
1answer
99 views

GCM mode of operation and IV size less 96 bits

GCM specification defines the initial counter value $Y_0$ for encryption/decryption operations as follows: $$ Y_0=\begin{cases} IV||0^{31}1 &\text{if len}(IV)=96\\ GHASH(H,\{\},IV)& \text{...
1
vote
2answers
345 views

Is it safe to use a counter as IV for AES256-GCM

What if I will use 96-bit integer counter starting from 0 as IV for AES256-GCM cipher. Is it safe? Is there any other ways to ensure uniqueness of IV for GCM cipher?
2
votes
1answer
129 views

Why is GCM not vulnerable at the birthday bound for 128 bit IV?

According to this article, which looks at attacks on Caesar candidates beyond what they claim, they include an attack on page 6 for nonce-respecting adversaries for AES-GCM which allows IVs longer ...
0
votes
2answers
413 views

Which is slower, AES or GCM hash (GHASH), if CPU has no special instructions?

In an answer to this question: Security of GCM if Implemented with Stream Cipher instead of Block Cipher ...it was stated that: The GHASH part of GCM is usually the problematic one when it comes to ...
0
votes
0answers
21 views

Can Galois/counter mode be used for stream ciphers (Galois/stream mode)? [duplicate]

The authenticated encryption mode of operation Galois/counter mode has recently gained acceptance because of its high performance due to its inherent parallelism and no pipeline stalls. It requires a ...
7
votes
1answer
1k views

TLS 1.2 Cipher Suites With AES-GCM – What data (if any) is passed to the AES-GCM cipher as the Additional Authentication Data?

TLS 1.2 defines a number of cipher suites that employ AES-GCM, e.g.: ...
3
votes
1answer
167 views

GCM mode GHASH sensitivity to timing attacks

In GCM mode of authenticated encryption, is it a security concern if the GHASH implementation timing can vary? If the timing varies according to the AAD/ciphertext data, it looks as though that doesn'...
3
votes
2answers
151 views

GCM mode and the order of AAD and plaintext

In GCM mode of encryption, what are the limitations on the mixing of plaintext and AAD (additional authenticated data)? Must the AAD come before the plaintext? Or could it be after the plaintext ...
3
votes
2answers
153 views

Generate $J_0$ for GCM cipher when $\operatorname{len}(IV) \neq 96$ bits

I have the following questions about the construction of J0 when is not equal to 96 bits, $s= 128\big\lceil \operatorname{len}(\text{IV})/128\big\rceil-\operatorname{len}(\text{IV})$ For example if ...
3
votes
0answers
106 views

How to break GCM that uses the same IV

I have an implementation that natively uses the same IV (12 bytes of 0) for all encryption. The key is always a 32 byte SHA-512 hash. I know via this post that I ...
1
vote
2answers
125 views

Does GHASH use XOR or addition?

I've been looking into GHASH and some sites describe it as a polynomial: A1*(H* *M-1)+A2*(H* *M-2)...C1*H(H* *M-N)+C2*H(H* *(M-N-1))...+len(A||C)*H+E(0)=t while ...
2
votes
1answer
1k views

AES-CBC then SHA vs AES-GCM for encrypting and authenticating a web token

I am trying to have something like JWT but kinda ad hoc and encrypted. The token itself is simply a stringified JSON that contains the user ID and Unix timestamp. Now, I tried to use AES-128-GCM, ...
3
votes
1answer
370 views

Do aes_256_gcm IVs just need to be unique for that key?

I'm using GCM (via openssl's EVP_EncryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL))). The IV's default length is 12 bytes. It says that the IV must be ...
1
vote
2answers
166 views

Does AES-GCM without security tag turn into regular CTR Mode?

We are looking to implement a simple password based key agreement scheme. Part of this is deriving a symmetric key from a common passphrase known to both parties involved. This symmetric key is then ...
2
votes
1answer
489 views

Would it be safe to store GCM nonce in the encrypted output?

I'm looking to use AES-256 GCM to encrypt and authenticate a file containing sensitive information. I am a bit loss on where to store the nonce that is required for GCM. Would it be adequate/safe to ...
1
vote
1answer
50 views

GCM cipher M0 tables : semantic questions on how to implement GCM

I`m reading the PDF "The Galois/Counter Mode of Operation (GCM)". In section 4.1 on the optimization of multiplications with tab, in algorithm 3 I have the following questions: A vector called M with ...