We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [gcm]

The Galois Counter Mode, an authenticated encryption mode of operation for a block cipher.

Filter by
Sorted by
Tagged with
19
votes
3answers
4k views

Plain text size limits for AES-GCM mode just 64GB?

Based on NIST SP 800-38D section 5.2.1.1, it seems that the maximum length of plaintext is 2^39-256 bits ~ 64 GB. We've got 100+GB files in genomics that need to be GCM encrypted so are concerned ...
9
votes
1answer
8k views

Where is the authentication tag stored in file encrypted using AES-GCM?

So I am using cryptopp to encrypt a file in a project and I am using AES-GCM. I have a 256bit key and a 128bit ivec and a 128bit tag that I use to encrypt files. However, I want to know where the ...
9
votes
1answer
120 views

GCM mode of operation with long-term keys

Regarding GCM, NIST specifies the following: The total number of invocations of the authenticated encryption function shall not exceed $2^{32}$, including all IV lengths and all instances of the ...
2
votes
1answer
71 views

Why can't AES-GCM be used in IKEv1 phase 1?

I was configuring a VPN on a firewall (fortigate) and realized that I could use AES-GCM for encryption in the IKEv1 phase 2 but not in the phase 1 and I was wondering why knowing that in IKEv2 we ...
4
votes
3answers
355 views

Nonce-misuse-resistance scheme applied after the fact to AES-GCM for defense in depth?

This is a follow-up to a previous question about encrypting IV/MAC results from AEAD ciphers. I have a system I'm working on that needs to use standard (NIST/FIPS) cryptography, at least for its ...
3
votes
1answer
163 views

Why doesn't GMAC/GCM encrypt its authentication tag?

As most know, a duplicate nonce with GMAC/GCM allows key recovery attacks against GMAC itself and thus the ability to forge messages. This is because GMAC computes GHASH and then just XORs this with ...
5
votes
1answer
89 views

AEAD (for AES128-GCM): is it necessary to add a zero-length AAD?

In an implementation of AEAD_AES_128_GCM, if the AAD is defined as a "zero-length octet sequence", is it necessary to call the encryption code that adds an AAD at all? In particular, does an OpenSSL/...
2
votes
1answer
112 views

Using an AES-256-GCM key as a salt to SHA-256

Assume 256 bit keys are randomly generated and data is encrypted using AES-GCM-256 prior to being sent to a server. The goal is to enable the server to determine uniqueness of data it receives ...
6
votes
2answers
493 views

Are tags longer than 128 bit possible for AES-256-CCM and AES-256-GCM?

I have an existing application that uses AES-256-CBC for encrypting data blocks, and HMAC-SHA-256 on the plaintext for eliminating duplicate data blocks. For performance reasons, I would like to move ...
2
votes
2answers
136 views

Any benefit to encrypting IV and MAC in a mode like AES-GCM or ChaChaPoly?

Would there be any benefit to symmetrically encrypting the IV and MAC in an AEAD mode of operation? More specifically would this prevent someone from exploiting the accidental use of a duplicate IV ...
1
vote
1answer
247 views

Is the Java function AES/CBC/PKCS5Padding vulnerable to padding oracle?

I have an application that stores data on the devices. Currently AES/CBC/PKCS5Padding from javax.crypto.Cipher(see reference) is ...
2
votes
1answer
51 views

Is AES-GCM suitable for per chunk encryption?

I was looking through Google's encryption flow and noticed that they split each file into chunks and then encrypt each chunk individually with AES-GCM with its own key. Since AES-GCM starts to get ...
8
votes
0answers
244 views

Unique GCM/CCM initial counters without recipient side message counters

I am implementing the encryption layer for a communication protocol. The bulk encryption method used is either AES-CCM or AES-GCM. Due to implementation details, encryption of packets is usually, but ...
0
votes
0answers
58 views

Generating the Backup Exec AES-256 GCM key used to encrypt/decrypt LTO5 tape drive data

I've got an LTO5 tape that was backed up using Backup Exec (BE), which used hardware compression when writing to the tape. I've been given the passphrase that BE used to create the actual encryption ...
1
vote
3answers
265 views

Is the Salsa20-GCM composition secure?

AES-GCM seems to be used by everyone, but I have never seen even one post about Salsa20-GCM. Is it secure? Wikipedia mentions ...
1
vote
2answers
72 views

Plain text size limits for AES-GCM mode at 2GB with Sun JCE implementation?

The Sun JCE implementation of GCM is hard coded to refuse to encode more than 2 Gb, through the function GaloisCounterMode.checkDataLength() that returns an error message : "SunJCE provider only ...
1
vote
1answer
392 views

AES-GCM cipher - Nonce vs IV

I am using a Python library called PyCryptodome, which offers the following API for AES-GCM ciphers: https://pycryptodome.readthedocs.io/en/latest/src/cipher/aes.html As you see, IV is not ...
7
votes
1answer
405 views

OCB and GCM security

Is OCB as secure as GCM or CCM ? Since OCB design is quite different from GCM and CCM, I was wondering if the security properties of these latters are satisfied by OCB, as well.
1
vote
1answer
81 views

Protocol Design for IoT devices having PSK using AES-GCM

Handshake: 1) Client To Server: "AES-GCM(Client_random_128bit,client_iv,psk),client_id,tag,client_iv" 2) Server To Client: "AES-GCM(Server_random_128bit,client_iv++,psk),tag ...
2
votes
1answer
116 views

Guessing the key in AES256-GCM? [duplicate]

I assume that my case is weird but I've the following information: IV: 0x263e or 0x3e26 Auth tag: 0x25 AES256-GCM encrypted payload: 0x4eec96df534ade4c013a AES256-GCM decrypted payload: ...
3
votes
1answer
561 views

Do aes_256_gcm IVs just need to be unique for that key?

I'm using GCM (via openssl's EVP_EncryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL))). The IV's default length is 12 bytes. It says that the IV must be ...
10
votes
2answers
4k views

How bad it is using the same IV twice with AES/GCM?

I understand that initialization vectors (IV) should not be used twice when using AES/GCM. I am using a counter as an initialization vector. Every time I send out a new packet (I am developing an UDP ...
1
vote
1answer
126 views

What is the Risk of Rotating Keys

This may be a difficult question So, $C_1$ = AES-GCM($k_1$, nonce, message) where nonce = HMAC(key,message). $C_2$ = AES-CBC($k_2$, iv, $C_1$). Now, a security breach occurs. The adversary obtains ...
0
votes
1answer
49 views

Does GCM improve the strenght of weak passwords?

If I am encrypting a file with GCM/AES256 with a weak key (say a sha256), does the fact that it takes time to brute force a long message improve my security? Example: I use the sha256 of "ARainyDay" ...
1
vote
1answer
542 views

Which one is faster GCM AES-128 or Curve25519?

As I know the symmetric encryption algorithms are faster than asymmetric encryption algorithms. But when I test GCM AES-128 and Curve25519 encryption time, I find Curve25519 is faster than GCM AES-128....
0
votes
1answer
50 views

GCM optimisation using $M_0$ and $R$ tables - Calculation of $R$

I'm implementing GCM in C as a way to learn about it. In the paper titled as The Galois/Counter Mode of Operation (GCM) by McGrew and Viega on chapter 4.1, page 11, 12, they talk about the ...
8
votes
3answers
1k views

Can a zero nonce be safely used with AES-GCM if the key is random and never used again?

I could generate a random nonce and prepend it to the ciphertext, but storage space is at a premium and the only constraint AES-GCM has on the nonce (if I'm reading correctly) is that the same nonce ...
1
vote
2answers
132 views

Is this a better GCM?

Using the keystream from the block cipher for both parts of the GMAC key (initialization and encrypting the auth tag) seems to produce a better mode of operation than GCM, as successful forgeries and ...
0
votes
0answers
136 views

Can I Achieve Deterministic Encryption Using AES-GCM with Nonce = HMAC [ message ]

I would like to implement a deterministic encryption scheme within .NET. From the following post it is established using AES-SIV mode is appropriate. As AES-SIV mode is not implemented within the ...
0
votes
0answers
28 views

Mixed HMAC / GMAC with fixed IV [duplicate]

I was just thinking about improving the performance of HMAC - what would be the issues in doing the following: Let $G_K(IV,M)$ be GMAC with a key $K$, for IV and message $M$. Let $H$ be a secure hash ...
6
votes
0answers
340 views

Why does the Signal protocol use AES/CBC instead of AES/GCM?

AES/GCM has obviously proved itself to be better than AES/CBC. Unless the key is re-used with the same initialization vector (see disadvantages of GCM). More information of its advantages against CBC ...
2
votes
1answer
3k views

AES-GCM encryption and decryption doubts

I'm using AES-GCM mode in my project and I have some doubts. ...
1
vote
1answer
125 views

AES-GCM cipher tag and IV size, while attempting to render encrypted ciphertext useless by removing them

I'm using AES in GCM mode of operation for encryption/decryption & authentication of segments of data in a file. The layout of each segment can be summerized by this diagram. Each segment is ...
0
votes
1answer
209 views

Do I need to worry about the IV if I use a 32 byte random salt with SCrypt and AES-GCM?

I am encrypting a DEK (data encryption key) with a KEK (key encryption key). The KEK is generated from a password using scrypt with default parameters and a 32 byte randomly generated salt. The ...
3
votes
1answer
813 views

Poly1305-AES vs AES-GCM

What are the advantages of Poly1305-AES over AES-GCM? Please note I am not talking about chacha20-Poly1305 that has been widely adopted, including by Google. But I would like to know pros and cons ...
2
votes
1answer
2k views

AES-CBC then SHA vs AES-GCM for encrypting and authenticating a web token

I am trying to have something like JWT but kinda ad hoc and encrypted. The token itself is simply a stringified JSON that contains the user ID and Unix timestamp. Now, I tried to use AES-128-GCM, ...
7
votes
1answer
957 views

What are the constraints on using GCM with a tag size of 96 and 128 bits?

Say we want to use AES (or any other secure 128 bit block cipher) with GCM and a tag size of 96 or 128 bits. I'm assuming an AES key size of 128 bits and an IV size of 96 bits (the default). NIST SP ...
2
votes
1answer
186 views

What should I use for consequent AES key derivation?

I am writing a small chat program to explore some methods and concepts in cryptography and currently I am using a shared AES key tunneled with RSA which upon further reading revealed many flaws both ...
0
votes
1answer
58 views

Using key derived using HKDF or NIST sp800-108 with AES-CCM/GCM

Is it safe to use keys derived using HKDF or NIST sp800-108 with AES-CCM/GCM ? The NIST SP800-108 and SP*00-56C spec says "To comply with this Recommendation, the derived keying material shall not be ...
2
votes
2answers
1k views

AES256 GCM IV guidelines

If I use for example AES256 (GCM), and my message is bigger than 256bit (breaked into smaller 256bit blocks for encryption), should the IV change every 256bit of the message?
4
votes
1answer
59 views

How to handle the extra 12451 elements in Sophie-Germain Counter Mode?

In Sophie-Germain Counter Mode (SGCM), the $GF(2^{128})$ field multiplication of Galois Counter Mode (GCM) is replaced with normal multiplication $\bmod 2^{128}+12451$. Because the block size is 128 ...
7
votes
0answers
136 views

GCM with reversed poly

These slides talk about how GCM can be sped up if one uses $x^{128}+x^{127}+x^{126}+x^{121}+1$ as the reduction polynomial instead of $x^{128}+x^7+x^2+x^1+1$. When one is doing that one needs to ...
17
votes
2answers
8k views

AES-GCM recommended IV size: Why 12 bytes?

When using AES-GCM, a 96-bit IV is generally recommended. Most implementations I've seen also use 96-bit. However, I'm unsure on where this recommendation or convention comes from. Let's assume a ...
9
votes
1answer
278 views

how does BearSSL's GCM modular reduction work?

BearSSL (in src/hash/ghash_ctmul.c) seems to be doing a modular reduction that I don't completely understand. Here's the code: ...
0
votes
1answer
92 views

How can you determine how long the MAC for GCM must be?

I want to use AES-GCM to encrypt 7 Byte data chunks. A 16 Byte MAC seems like overkill to me and the library I'm using gives me the option to make the MAC smaller. ...
1
vote
1answer
72 views

With AES-GCM, may I use multiple tags per key?

In my implementation of AES-GCM, the key might change only once per minute. However, I wish to calculate a new tag every 6us, to reduce latency (since you have to buffer up a GCM "packet" before ...
1
vote
2answers
321 views

how does AES GCM in SSH work?

I was looking at RFC5647: AES Galois Counter Mode for the Secure Shell Transport Layer Protocol and had some questions about section 7.1 "IV and Counter Management". Here's that section: ...
1
vote
2answers
90 views

Implementations of GCM with 64-bit cipher

The paper The Galois/Counter Mode of Operation (GCM) describes mainly the 128-bit case, for use with 128-bit block ciphers such as AES. AES-GCM test vectors are available from NIST. The paper also ...
5
votes
1answer
570 views

Why doesn't the GCM spec use a more efficient multiplication algorithm?

NIST SP 800-38D § 6.3 Multiplication Operation on Blocks describes a multiplication algorithm that, in my testing, appears to be a good amount slower then algorithm 2.40 (arbitrary reduction ...
1
vote
1answer
83 views

GHASH with a finite field multiplication algorithm in reverse order

NIST SP 800-38D § 6.4 GHASH Function describes the GHASH algorithm thusly: Prerequisites: block $H$, the hash subkey. Input: bit string $X$ such that len($X$) = $128m$ for some positive ...