Questions tagged [gcm]
The Galois Counter Mode, an authenticated encryption mode of operation for a block cipher.
296
questions
0
votes
1
answer
26
views
AES-GCM and tag length
Due to protocol limitations, I can put in 24 bytes of data only for tx (excluding headers), if I use AES_GCM for encrypting my data, I understand I don't need to worry about padding.
So for instance, ...
2
votes
1
answer
223
views
Is it possible to reverse GHASH from GCM?
How can I create a "reverse" GHASH algorithm for GCM that allows me to compute an input value that generates a specific chosen output, given that I know the authentication key H? If this is ...
- 29
4
votes
2
answers
755
views
OpenSSL AES-GCM says 'bad decrypt', other block modes work fine?
If I do a simple encrypt and decrypt test like so:
...
- 1,387
1
vote
0
answers
362
views
BAD Record MAC error from the server [closed]
I am working on ssl client because of some server update I was enabling the cipher TLS_DHE_RSA_WITH_AES_128_GCM_SHA256. While handshake with server I was facing Bad Record MAC Alert message from the ...
3
votes
2
answers
369
views
Why the polynomial of GCM is primitive?
I'm interested on the polynomial used in GCM-mode : $X^{128}+X^7+X^2+X+1$
This polynomial is Primitive (in $\mathbb{F}_2$).
What is the interest of choosing a primitive polynomial and not a simple ...
- 2,523
0
votes
2
answers
142
views
Why GCM is used more often than CTR?
I've seen (on Wikipedia) in the more recent version of TLS, the Counter-mode was not used. But the Galois-Counter-mode was used?
What is the advantage to use the GCM instead of using the Counter-mode?
- 2,523
5
votes
3
answers
716
views
Is 'authenticated' in AEAD actually authentication? Or is it message integrity?
Despite working with AES-GCM and other AEAD algos for a few years, I've struggled with the concept of 'authenticated' in the term 'AEAD'. In my own experience (of Unix, PKI and blockchain) ...
- 417
1
vote
1
answer
133
views
Is it normal that cypertext size can be smaller than IV when using AES-256-GCM?
I noticed that when using AES-256-CBC with a 128-bit IV, the ciphertext is always at least 16 bytes long (size of IV).
I also noticed that when using AES-256-GCM with a 96-bit IV, the ciphertext size ...
- 189
2
votes
0
answers
36
views
Secure option for (hybrid) encryption of a secret key using JWE
I want to encrypt a private key $sk$ (it's actually an RSA private key in PKCS#8 format) with another person's (and/or my) public key $pk_A$ for secure storage. With JWE, it is possible to use hybrid ...
8
votes
1
answer
1k
views
Would an encryption-only block cipher be useful at all?
I recently implemented AES block cipher, encryption side only, to be used in QUIC parsing (QUIC uses GCM mode). There are other modes than GCM that use only encryption: for example CTR, OFB, and CFB.
...
- 1,227
0
votes
0
answers
98
views
Is AES-256-CBC secure in the context of offline encrypted backups?
My understanding is that AES-256-GCM is more secure given it supports authentication.
Also, my understanding is that AES-256-CBC is vulnerable to “chosen-plaintext”, “chosen-ciphertext” and “padding ...
- 189
1
vote
1
answer
60
views
How does a GMAC in GCM not nullify the utility of a seekable decrypt-able stream
I have been looking at the Galois/Counter Mode (GCM) for stream encryption. I understand the idea that it's a stream cipher and so it can be encrypted one bit at a time by XORing with the key stream ...
- 113
1
vote
2
answers
343
views
Why does AES-GCM means No MAC key, instead of MAC key what they are going to use?
From RFC 5246, section 6.2.3.3: AEAD Ciphers:
AEAD ciphers take as input a single key, a nonce, a plaintext, and "additional data" to be included in the authentication check, as described in ...
- 49
1
vote
1
answer
212
views
Does deriving a key from a master key and then encrypting with AES-GCM increase the lifetime of the master key?
Suppose that we have a symmetric 256-bit master key, and we want to encrypt using AES-GCM with random IVs. I understand that with random IVs, the lifetime of the master key is 2^32 in order to conform ...
- 11
2
votes
1
answer
1k
views
Validating AES GCM authentication tag between two different implementations
I'm a bit confused on how to validate the authentication tag between two different AES GCM implementations.
One implementation (on my part) is in Java. The other, I don't know.
In my implementation, ...
- 23
1
vote
1
answer
157
views
Multiple Encryption Using GCM For Multi-Key Security
Multiple Encryption For Multi-Key Security
I have a hypothetical question about multiple encryption after reading Matthew Green’s blog on multiple encryption. For those who are familiar with GCM…I ...
- 11
1
vote
1
answer
517
views
How is TLS 1.3 application data encrypted with AES-GCM sent 'over the wire'?
I've been trying to manually decrypt some TLS 1.3 traffic for educational reasons, and have stumbled across a roadblock. So far, I've been able to complete most of the key schedule, including deriving ...
- 131
1
vote
1
answer
277
views
Performance of AES CTR + HMAC SHA1
I'm doing a performance test on AES with CTR mode and HMAC SHA1 for message authentication and found the openssl speed tool for that.
I run multiple tests with <...
- 115
0
votes
1
answer
130
views
CTR HMAC SHA1 vs GCM Key management
The protocol SRTP uses by default AES in CTR mode with HMAC-SHA1.
For my thesis I want to research if GCM would be a better option.
Therefore I read following discussion.
There the answer was that GCM ...
- 115
1
vote
1
answer
92
views
Understanding the algebra behind GCM's security
I would like to understand the algebra behind GCM's security. Before I ask my questions, let me state my understanding of the math behind GCM. If correct, my questions are at the end; if incorrect, ...
- 135
4
votes
1
answer
577
views
Java: SecureRandom.getInstanceStrong() vs new SecureRandom()
Given SecureRandom class is considered suitable for use in cryptography, I consider new SecureRandom() to be secure (funny term, ...
- 481
0
votes
1
answer
163
views
How to produce Auth Data and tag in GCM? Does MAC appended CTR mode encrypted text weaker than GCM?
In https://en.wikipedia.org/wiki/Galois/Counter_Mode, there's a diagram which tells us how GCM works in general.
I have watched computerphile video on how ECB,CBC and CTR mode works and able to ...
- 115
4
votes
1
answer
319
views
Is GCM with zero-length AAD less secure?
In a previous question, it was made clear that in the case of GCM, there is no distinction between "no AAD" and "zero-length AAD". Since I have noticed "zero-length AAD" ...
- 171
4
votes
1
answer
178
views
Lack of response to CAESAR competition
Why is there so little response (e.g. implementation in crypto libraries, programs...) after the end of the CAESAR competition? As far as I can see, there is no shift from AES-GCM to any of the CAESAR ...
- 925
0
votes
1
answer
113
views
Security level of Poly1305 and GMAC
The Libsodium docs list the AEAD forgery limits for ChaCha20Poly1305 and AES-GCM which seems like a < 128-bit security level but says that it's not a practical concern. I've seen other people say ...
- 3
2
votes
1
answer
105
views
How does Authentication-Key Recovery for GCM work?
In his Paper "Authentication weaknesses in GCM" Ferguson describes, how some bits of the error polynomial can be set to zero, thereby increasing significantly the chance of a forgery.
Q: ...
- 1,477
3
votes
1
answer
121
views
Factorization of polynomial in GF(2^128) used in GCM
It is widely known, that using a GCM nonce twice or even more often can be used to disclose the authentication key H. I understand, why this is theoretically possible. However, I have no feeling about ...
- 1,477
1
vote
1
answer
298
views
Why using same nonce (IV) twice voids confidentiality of plain text or even key?
I understand roughly (without details of GF algebra) the scheme of GCS/GMAC:
IV is to be put into Counter-0, so initializing counters.
It is known, that using a IV twice can not only reveal the plain ...
- 1,477
0
votes
1
answer
963
views
AES-GCM can IV be stored alongside in DB?
I'm trying to encrypt and store strings in PHP as per example #1 on the PHP openssl_encrypt documentation.
...
- 103
1
vote
0
answers
550
views
How can I decrypt AES-256 GCM with key with a IV that is missing?
I want to decrypt a file that has been encrypted using AES-256 in GCM mode in libressl. I have the key but I don't have the IV, is there any way I can still decrypt?
- 11
2
votes
1
answer
68
views
Is it possible to do partial message authentication?
I want to authenticate part of a message, not all of it, while creating the MAC over the entire message. Let's say I create a 16B MAC over one hundred message blocks that are 64B each. Then I send one ...
0
votes
0
answers
377
views
Where to get AES GCM NIST-like test cases
I'm implementing AES GCM 256 bit at the moment. Now I'm finished with copying the content of the standard as a program and now have to make it actually work. With the test cases in the official NIST ...
- 101
0
votes
1
answer
64
views
Authentication in Lattice PQC candidates
I am looking into Authentication in lattice cryptography. Specifically in the NIST KEM finalists. I was specifically looking to see if there was a GCM (Galois counter mode) equivalence in the lattice ...
- 51
17
votes
5
answers
3k
views
AES GCM : is it acceptable to return the wrong plaintext if the tag is incorrect?
Let's start by saying I'm no cryptography expert, I'm just a developer, so feel free to correct me (using words, not downvotes) if what I'm saying is non-sense.
Context: I'm doing some crypto as a ...
- 273
0
votes
2
answers
722
views
what is auth data in AES-GCM
I am trying to understand AES-GCM and I do not understand what I should transmit to Auth Data during encryption. What kind of data is that?
0
votes
2
answers
4k
views
AES/GCM/PKCS5Padding giving issues while AES/CBC/PKCS5Padding works fine for my use case
I have a requirement to read-encypt-save plus its reverse i.e. read-decypt-save files through chunk/block mechanism (single operation not feasible because of huge(GBs) file sizes).
So essentially the ...
- 101
0
votes
0
answers
21
views
Why does AES_GCM sometimes has a SHA for integrity? [duplicate]
For example the following suite:
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
From what I understand the SHA384 at the end is used to authenticate the message, which is exactly what MAC does, and the mode ...
- 11
5
votes
1
answer
329
views
How does GHASH used in GCM behave as a universal hashing function?
As per my understanding, a Universal Hash Function isn't a cryptographic hash function & it's output isn't uniformly distributed. However, this is still secure because it's actually a family of ...
- 2,251
3
votes
1
answer
105
views
What are the implications of allowing a zero-length GCM nonce?
NIST SP800-38D section 5.2.1.1 is clear that empty nonces are not allowed with GCM, but without explaining the reasoning. My assumption was this is simply because the probability of error (encrypting ...
- 1,674
2
votes
1
answer
748
views
What is the overhead of GCM? And how are GCM tags signed by RSA/PKI?
I'm mainly trying to wrap my head around the pipeline of encryption, hashing and signing.
I've read over this question, describing the overhead of GCM, which I understand to be configurable for space-...
- 205
0
votes
0
answers
99
views
Is this a reasonable design for encrypting records in a key/value database?
A while back I designed a protocol for en encrypted key/value service. My main goal was to minimize the value of a breached database by using cryptographic algorithms where a brute-force cracking ...
- 101
4
votes
1
answer
277
views
Is a stream cipher and a (cryptographically secure) PRNG nearly the same thing?
If I let the authentification tag aside (which is important), encrypting with AES-GCM and a fixed key and nonce:
...
- 533
3
votes
2
answers
529
views
Does it make any sense to sign a GCM authentication tag with RSA?
To achieve double insurance for authentication, can we sign the GCM final tag with using RSA?
with RSA, no one is able to create his own tag since the private key is not known.
However, according to ...
- 61
7
votes
1
answer
661
views
How to securely encrypt/decrypt data with a maximum chunk size?
I am aware of the different modes so that a "raw" block cipher such as AES (ECB) can be used to encrypt more than a single block of data (CBC, OFB, CTR, etc) and modes such as AES-GCM which ...
3
votes
3
answers
1k
views
Designing a secure UDP-based communication protocol
SUMMARY UPDATE:
I have changed the title of this question from "Using an encrypted packet counter as a counter value in AES-CTR" to "Designing a secure UDP-based communication protocol&...
- 141
4
votes
0
answers
466
views
Is AES-GCM-SIV with fixed IV deterministic authenticated encryption?
Is there any functional or strong security difference beyond speed between
AES-GCM-SIV with implicit fixed public IV and no additional data
AES-CTR (or AES-OFB) with 128-bit IV computed per HMAC-SHA-...
- 132k
3
votes
1
answer
660
views
Is it dangerous to encrypt lots of small files with the same key?
I want to encrypt 1000s of old files on old hard drives before uploading them to the cloud. I'm planning to use AES-GCM with only one or a few keys. (I'm using Apple's CryptoKit library which provides ...
- 133
3
votes
1
answer
239
views
AES-GCM ciphertext that deciphers under two keys
How can we exhibit an AES-GCM ciphertext, including IV and 128-bit authentication tag, and distinct keys $K_0$ and $K_1$, so that decryption succeeds for both keys?
What degree of control do we have ...
- 132k
2
votes
3
answers
2k
views
Can AES GCM mode detect an incorrect key and refuse to decrypt?
I understand that AES in GCM mode produces an authentication tag that is used to ensure that a tampered with cipher text is not decrypted. However, if I pass the wrong key will AES in GCM mode detect ...
- 531
0
votes
1
answer
2k
views
Is XTS always better than GCM?
XTS is suitable for disk encryption while GCM doesn't.
Both require the same number of block encryption calls.
Both are parallel in encryption and decryption.
XTS is actually even faster in openssl ...
- 113