Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs

Questions tagged [gcm]

The Galois Counter Mode, an authenticated encryption mode of operation for a block cipher.

Filter by
Sorted by
Tagged with
25 votes
3 answers
40k views

AES-GCM and its IV/nonce value

I was reading about the differences between the GCM and the CBC modes here and I have a follow up question: In the CBC mode the person who performs the encryption is the one who provides the IV for ...
92 votes
2 answers
173k views

What is the difference between CBC and GCM mode?

I am trying to learn more about GCM mode and how it differs from CBC. I already know that GCM provides a MAC, which is used for message authentication. From what I have read and from the code snippets ...
3 votes
3 answers
3k views

RSA digital signature vs authenticated cipher

I want to provide both confidentiality and integrity for data at rest (many large files stored on disk). I plan to encrypt the data using AES, which will cover the confidentiality requirement. The ...
0 votes
1 answer
101 views

Row level database encryption scheme

I am developing a row level database encryption scheme. Ideally I would not do this and instead rely on something vetted, but I haven't been able to find such a scheme online. My primary concerns are: ...
1 vote
1 answer
297 views

Multiple Encryption Using GCM For Multi-Key Security

Multiple Encryption For Multi-Key Security I have a hypothetical question about multiple encryption after reading Matthew Green’s blog on multiple encryption. For those who are familiar with GCM…I ...
1 vote
1 answer
210 views

GCM Create M tables and R

I am trying to optimize GCM multiplication. This PDF explains GCM: The Galois/Counter Mode of Operation (GCM) The algorithms are in section 4.1 In algorithm 3 I have to multiply table M [128] ...
3 votes
1 answer
155 views

High volume encryption with AES-GCM: AWS KMS vs CloudHSM

In my current project we will have to encrypt a lot of S3 objects (a few billions) with AWS KMS. Our security department requires that we use KMS keys backed by CloudHSM. But since CloudHSM incurs ...
5 votes
1 answer
231 views

What best to put in unused nonce bytes when using AES-GCM-SIV

I want to use AES-GCM-SIV for authenticated encryption of messages in my protocol. Since it is a wireless protocol I want to transmit as few bytes as possible. For successful decryption I need to ...
10 votes
1 answer
3k views

Poly1305-AES vs AES-GCM

What are the advantages of Poly1305-AES over AES-GCM? Please note I am not talking about chacha20-Poly1305 that has been widely adopted, including by Google. But I would like to know pros and cons ...
1 vote
1 answer
126 views

Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit, why Not 2^39 [duplicate]

While examining the initial GCM specification by McGrew and Viega in 2005, it appears that the formation of the 128-bit Initialization Vector by combining a 96-bit nonce and a 32-bit unsigned wrapping ...
33 votes
2 answers
8k views

Disadvantage AES-GCM

What are the disadvantages and weaknesses of AES-GCM mode for authenticated encryption? Why does the CAESAR competition say that it’s one of the goals to "find an AE scheme that offers an ...
0 votes
0 answers
153 views

AES-GCM with a fixed IV but a random "wrapped" key

It is well-known that AES-GCM requires the IV to be unique for each message that is encrypted with the same key. If the IV ever repeats, with the same key, then AES-GCM fails catastrophically. Now, ...
8 votes
2 answers
406 views

Lack of response to CAESAR competition

Why is there so little response (e.g. implementation in crypto libraries, programs...) after the end of the CAESAR competition? As far as I can see, there is no shift from AES-GCM to any of the CAESAR ...
4 votes
2 answers
537 views

Key commitment in GCM (or AEAD in general)

Many of the presentations at The Third NIST Workshop on Block Cipher Modes of Operation 2023 complain about the lack of key commitment in AES-GCM. But isn't that one application of "associated ...
10 votes
3 answers
15k views

Encryption of big files in Java with AES/GCM

I have to encrypt big files. Say their size ranges from 500mb to several of gigabytes. I would like to use AES/GCM/NoPadding as provided by Java 1.8 since that gives me automatic authentication and ...
0 votes
0 answers
89 views

Is it possible to uncover the plaintext if IV is used twice but the key is different?

I am currently working on a cryptography challenge. The program uses AES-GCM to encrypt and decrypt strings. Let's say I have the following: IV which is reused only 1 cipher text authentication tag ...
1 vote
1 answer
86 views

Newbie question about AES-GCM and IV

Imagine a channel where the initial secret for deriving of the actual key is established with ECDH. First, that shared secret is used to derive a temporary key with some default parameters (salt, ...
0 votes
0 answers
52 views

Encrypted Alert21- Error code 214

I am working on TLS 1.2 Cipher TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, After send the application data server throws an error message ...
13 votes
2 answers
25k views

Where is the authentication tag stored in file encrypted using AES-GCM?

So I am using cryptopp to encrypt a file in a project and I am using AES-GCM. I have a 256bit key and a 128bit ivec and a 128bit tag that I use to encrypt files. However, I want to know where the ...
1 vote
1 answer
95 views

DTLS 1.2 Cipher Suites With AES-GCM – What data (if any) is passed to the AES-GCM cipher as the Additional Authentication Data?

It is DTLS 1.2 version question of this question. I know from 4.1.2.4. of RFC 5246 (DTLS 1.2) AEAD Ciphers can be used in DTLS 1.2 exactly the same with TLS 1.2. In TLS 1.2 AAD = seq_num + ...
1 vote
1 answer
685 views

How does AES-GCM and AES-CCM provide authenticity?

My lecture notes state that of the AES operating modes ECB, CBC, CTR, CCM (CTR+CBC MAC) and GCM, only CCM and GCM provide authenticity. In CCM, as I understand it, the authenticity lies in the MAC, i....
1 vote
2 answers
1k views

AES-GCM and tag length

Due to protocol limitations, I can put in 24 bytes of data only for tx (excluding headers), if I use AES_GCM for encrypting my data, I understand I don't need to worry about padding. For instance, if ...
3 votes
1 answer
117 views

What kind of hashing is GF multiplication in GCM cipher mode and GMAC?

In GCM, GMAC, the additional associated data (AAD) (as well as outputs of subsequent blocks) is multiplied by a polynomial H in GF(2^128). This appears to be doing some secure hashing. Is that what's ...
2 votes
1 answer
343 views

Is it possible to reverse GHASH from GCM?

How can I create a "reverse" GHASH algorithm for GCM that allows me to compute an input value that generates a specific chosen output, given that I know the authentication key H? If this is ...
4 votes
2 answers
2k views

OpenSSL AES-GCM says 'bad decrypt', other block modes work fine?

If I do a simple encrypt and decrypt test like so: ...
1 vote
0 answers
1k views

BAD Record MAC error from the server [closed]

I am working on ssl client because of some server update I was enabling the cipher TLS_DHE_RSA_WITH_AES_128_GCM_SHA256. While handshake with server I was facing Bad Record MAC Alert message from the ...
3 votes
2 answers
399 views

Why the polynomial of GCM is primitive?

I'm interested on the polynomial used in GCM-mode : $X^{128}+X^7+X^2+X+1$ This polynomial is Primitive (in $\mathbb{F}_2$). What is the interest of choosing a primitive polynomial and not a simple ...
0 votes
2 answers
2k views

Why GCM is used more often than CTR?

I've seen (on Wikipedia) in the more recent version of TLS, the Counter-mode was not used. But the Galois-Counter-mode was used? What is the advantage to use the GCM instead of using the Counter-mode?
5 votes
3 answers
990 views

Is 'authenticated' in AEAD actually authentication? Or is it message integrity?

Despite working with AES-GCM and other AEAD algos for a few years, I've struggled with the concept of 'authenticated' in the term 'AEAD'. In my own experience (of Unix, PKI and blockchain) ...
1 vote
1 answer
208 views

Is it normal that cypertext size can be smaller than IV when using AES-256-GCM?

I noticed that when using AES-256-CBC with a 128-bit IV, the ciphertext is always at least 16 bytes long (size of IV). I also noticed that when using AES-256-GCM with a 96-bit IV, the ciphertext size ...
2 votes
0 answers
71 views

Secure option for (hybrid) encryption of a secret key using JWE

I want to encrypt a private key $sk$ (it's actually an RSA private key in PKCS#8 format) with another person's (and/or my) public key $pk_A$ for secure storage. With JWE, it is possible to use hybrid ...
0 votes
0 answers
133 views

Using OpenSSL to emulate LTO 4 tape encryption

I have a mix of LTO 4 and LTO 3 tapes I would like to encrypt data on to. LTO 4 has built in encryption - load they key into the drive, and it handles the AES-256-GCM encyption transparently. LTO 3 ...
8 votes
1 answer
1k views

Would an encryption-only block cipher be useful at all?

I recently implemented AES block cipher, encryption side only, to be used in QUIC parsing (QUIC uses GCM mode). There are other modes than GCM that use only encryption: for example CTR, OFB, and CFB. ...
1 vote
1 answer
76 views

How does a GMAC in GCM not nullify the utility of a seekable decrypt-able stream

I have been looking at the Galois/Counter Mode (GCM) for stream encryption. I understand the idea that it's a stream cipher and so it can be encrypted one bit at a time by XORing with the key stream ...
1 vote
2 answers
1k views

Why does AES-GCM means No MAC key, instead of MAC key what they are going to use?

From RFC 5246, section 6.2.3.3: AEAD Ciphers: AEAD ciphers take as input a single key, a nonce, a plaintext, and "additional data" to be included in the authentication check, as described in ...
1 vote
1 answer
368 views

Does deriving a key from a master key and then encrypting with AES-GCM increase the lifetime of the master key?

Suppose that we have a symmetric 256-bit master key, and we want to encrypt using AES-GCM with random IVs. I understand that with random IVs, the lifetime of the master key is 2^32 in order to conform ...
2 votes
1 answer
3k views

Validating AES GCM authentication tag between two different implementations

I'm a bit confused on how to validate the authentication tag between two different AES GCM implementations. One implementation (on my part) is in Java. The other, I don't know. In my implementation, ...
4 votes
1 answer
355 views

Is a stream cipher and a (cryptographically secure) PRNG nearly the same thing?

If I let the authentification tag aside (which is important), encrypting with AES-GCM and a fixed key and nonce: ...
7 votes
2 answers
19k views

Is the Java function AES/CBC/PKCS5Padding vulnerable to padding oracle?

I have an application that stores data on the devices. Currently AES/CBC/PKCS5Padding from javax.crypto.Cipher(see reference) is ...
2 votes
1 answer
1k views

How is TLS 1.3 application data encrypted with AES-GCM sent 'over the wire'?

I've been trying to manually decrypt some TLS 1.3 traffic for educational reasons, and have stumbled across a roadblock. So far, I've been able to complete most of the key schedule, including deriving ...
1 vote
1 answer
522 views

Performance of AES CTR + HMAC SHA1

I'm doing a performance test on AES with CTR mode and HMAC SHA1 for message authentication and found the openssl speed tool for that. I run multiple tests with <...
0 votes
1 answer
202 views

CTR HMAC SHA1 vs GCM Key management

The protocol SRTP uses by default AES in CTR mode with HMAC-SHA1. For my thesis I want to research if GCM would be a better option. Therefore I read following discussion. There the answer was that GCM ...
2 votes
2 answers
3k views

AES-GCM: Verification before Decryption

I am looking at ChaCha20Poly1305 WolfSSL. It is noted that the ChaCha20Poly1305 AEAD construction has the property, that it only outputs the plaintext, if the verification of the MAC (Authentication ...
1 vote
1 answer
123 views

Understanding the algebra behind GCM's security

I would like to understand the algebra behind GCM's security. Before I ask my questions, let me state my understanding of the math behind GCM. If correct, my questions are at the end; if incorrect, ...
4 votes
1 answer
1k views

Java: SecureRandom.getInstanceStrong() vs new SecureRandom()

Given SecureRandom class is considered suitable for use in cryptography, I consider new SecureRandom() to be secure (funny term, ...
7 votes
1 answer
1k views

How to securely encrypt/decrypt data with a maximum chunk size?

I am aware of the different modes so that a "raw" block cipher such as AES (ECB) can be used to encrypt more than a single block of data (CBC, OFB, CTR, etc) and modes such as AES-GCM which ...
0 votes
1 answer
268 views

How to produce Auth Data and tag in GCM? Does MAC appended CTR mode encrypted text weaker than GCM?

In https://en.wikipedia.org/wiki/Galois/Counter_Mode, there's a diagram which tells us how GCM works in general. I have watched computerphile video on how ECB,CBC and CTR mode works and able to ...
4 votes
1 answer
633 views

Is GCM with zero-length AAD less secure?

In a previous question, it was made clear that in the case of GCM, there is no distinction between "no AAD" and "zero-length AAD". Since I have noticed "zero-length AAD" ...
1 vote
2 answers
2k views

CBC related TLS cipher suites to be disabled in the server side

I understand the TLS cipher suites using CBC mode are susceptible to timing attacks. From that understanding it seems that the cipher suites using GCM (CTR-based) are safe to use considering they don'...
8 votes
1 answer
2k views

Use Initialization Vector as Additional Authenticated Data

Cipher is GCM-AES. Is it acceptable/recommended to store the IV as AAD? Any popular examples?

1
2 3 4 5
7