Questions tagged [gcm]

The Galois Counter Mode, an authenticated encryption mode of operation for a block cipher.

Filter by
Sorted by
Tagged with
0
votes
0answers
13 views

GCM mode for AAD in javax.crypto library [migrated]

I have a question about this library and GCM in general. I understand GCM mode can both encrypt and authenticate data, or merely just authenticate it. With the javax library, if I want to authenticate ...
2
votes
1answer
76 views

What is the overhead of GCM? And how are GCM tags signed by RSA/PKI?

I'm mainly trying to wrap my head around the pipeline of encryption, hashing and signing. I've read over this question, describing the overhead of GCM, which I understand to be configurable for space-...
0
votes
0answers
59 views

Is this a reasonable design for encrypting records in a key/value database?

A while back I designed a protocol for en encrypted key/value service. My main goal was to minimize the value of a breached database by using cryptographic algorithms where a brute-force cracking ...
1
vote
1answer
72 views

Is a stream cipher and a (cryptographically secure) PRNG nearly the same thing?

If I let the authentification tag aside (which is important), encrypting with AES-GCM and a fixed key and nonce: ...
3
votes
2answers
309 views

Does it make any sense to sign a GCM authentication tag with RSA?

To achieve double insurance for authentication, can we sign the GCM final tag with using RSA? with RSA, no one is able to create his own tag since the private key is not known. However, according to ...
4
votes
1answer
69 views

How to securely encrypt/decrypt data with a maximum chunk size?

I am aware of the different modes so that a "raw" block cipher such as AES (ECB) can be used to encrypt more than a single block of data (CBC, OFB, CTR, etc) and modes such as AES-GCM which ...
4
votes
2answers
464 views

What are the popular modes-of-operation (AES-GCM, AES-SIV, AES-GCM-SIV, etc.) geared for?

I'm interested in developing software capable of encrypting personal files (which will ultimately be backed up to the cloud) and have been doing my best to follow best practices. There are many forms ...
6
votes
1answer
7k views

GCM padding or not?

In this question on StackOverflow https://stackoverflow.com/questions/31248777/can-pkcs5padding-be-in-aes-gcm-mode it's said that GCM doesn't require a padding: why?
4
votes
3answers
203 views

Designing a secure UDP-based communication protocol

SUMMARY UPDATE: I have changed the title of this question from "Using an encrypted packet counter as a counter value in AES-CTR" to "Designing a secure UDP-based communication protocol&...
3
votes
0answers
95 views

Is AES-GCM-SIV with fixed IV deterministic authenticated encryption?

Is there any functional or strong security difference beyond speed between AES-GCM-SIV with implicit fixed public IV and no additional data AES-CTR (or AES-OFB) with 128-bit IV computed per HMAC-SHA-...
1
vote
1answer
178 views

Is it dangerous to encrypt lots of small files with the same key?

I want to encrypt 1000s of old files on old hard drives before uploading them to the cloud. I'm planning to use AES-GCM with only one or a few keys. (I'm using Apple's CryptoKit library which provides ...
3
votes
1answer
91 views

AES-GCM ciphertext that deciphers under two keys

How can we exhibit an AES-GCM ciphertext, including IV and 128-bit authentication tag, and distinct keys $K_0$ and $K_1$, so that decryption succeeds for both keys? What degree of control do we have ...
2
votes
3answers
253 views

Can AES GCM mode detect an incorrect key and refuse to decrypt?

I understand that AES in GCM mode produces an authentication tag that is used to ensure that a tampered with cipher text is not decrypted. However, if I pass the wrong key will AES in GCM mode detect ...
1
vote
2answers
100 views

Mixing block cipher modes (AES)

I'm trying to evaluate some changes to an existing codebase and one question that has come up is the block cipher mode. For legacy reasons we've been using AES in CBC mode, however it's unclear why ...
0
votes
1answer
95 views

Is XTS always better than GCM?

XTS is suitable for disk encryption while GCM doesn't. Both require the same number of block encryption calls. Both are parallel in encryption and decryption. XTS is actually even faster in openssl ...
2
votes
1answer
27 views

Best suitable column type for openssl $tag,$iv,$key,$encrypted?

Which column type is best for storing $tag, $iv, $key, $encryptedData generated by openssl_encryption, and in which format I should save these values? I am using &...
1
vote
1answer
45 views

Number message limits of Galois/Counter Mode (GCM) per key

In https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf page 27, it is said that ...the total number of blocks of plaintext and AAD that are protected by invocations of the ...
3
votes
2answers
122 views

Extending AES-GCM initialization vector

We all know that applications of crypto primitives like to not think about the management of nonces, and initialization vectors and often prefer to just set them to random values. This sometimes leads ...
2
votes
2answers
487 views

AES-GCM: Verification before Decryption

I am looking at ChaCha20Poly1305 WolfSSL. It is noted that the ChaCha20Poly1305 AEAD construction has the property, that it only outputs the plaintext, if the verification of the MAC (Authentication ...
33
votes
1answer
28k views

Ciphertext and tag size and IV transmission with AES in GCM mode

I am completely new to using AES in GCM mode of operation, and I have not a very large background in cryptography as well. I have been playing with OpenSSL trying to encrypt and decrypt some messages. ...
4
votes
4answers
2k views

Which is more secure using a CSPRNG for a One-time pad, or AES?

In reading about the One-time pad it appears to need truly random key for the pad. Since true random values are not practical to generate this presents a problem (thus making One-time pad less ...
15
votes
1answer
8k views

GCM vs CTR+HMAC tradeoffs

So these days I see everyone using AES-GCM. What are its advantages over simple CTR+HMAC modes? Is it speed? Or ciphertext length? And what are the security tradeoffs, both in terms of practical ...
2
votes
1answer
194 views

The Security of AES-N-GCM

In the paper The Security and Performance of the GaloisCounter Mode(GCM) of Operation,it shows the AES GCM SECURITY in Corollary 1. there are no distinguishing attacks against AES-N-GCM that work ...
0
votes
0answers
23 views

Authenticating and encrypting data for an automated system

I wish to distribute a file from A to an automated system B. The requirements are: Contents are encrypted Contents are tamper proof Contents origin is verified To do this I have devised the ...
0
votes
1answer
41 views

implications of shor's algorithm on $F_{2^m}$ elliptic curves and GHASH

The security of elliptic curves depends on the difficulty of the discrete logarithm problem. Should Shor's Algorithm ever prove viable then elliptic curves would cease to offer any useful security ...
3
votes
1answer
84 views

GCM Construction of table M0

I am reading the paper on GCM The Galois/Counter Mode of Operation (GCM) . I have some doubts about the implementation of table M0 and R. When I have to multiply by the variable P it is ...
10
votes
1answer
293 views

Unique GCM/CCM initial counters without recipient side message counters

I am implementing the encryption layer for a communication protocol. The bulk encryption method used is either AES-CCM or AES-GCM. Due to implementation details, encryption of packets is usually, but ...
0
votes
0answers
34 views

GCM Create M tables and R

I am trying to optimize GCM multiplication, I am reading the pdf that explains such a thing, it is this: The Galois/Counter Mode of Operation (GCM) The algorithms are in section 4.1 In ...
5
votes
1answer
1k views

Poly1305-AES vs AES-GCM

What are the advantages of Poly1305-AES over AES-GCM? Please note I am not talking about chacha20-Poly1305 that has been widely adopted, including by Google. But I would like to know pros and cons ...
0
votes
1answer
61 views

Does the authentification in GCM serve the same purpose as CRC32?

The purpose of the authentification is to ensure the data integrity. Let's just focus on the authentification part of the GCM which is using the Galois field multiplication to create an ...
82
votes
1answer
143k views

What is the difference between CBC and GCM mode?

I am trying to learn more about GCM mode and how it differs between CBC. I already know that GCM provides a MAC which is used for message authentication. From what I have read, and from the code ...
3
votes
1answer
84 views

Is there an increased risk of nonce reuse when using GCM with a nonce more than 96 bits?

GCM is designed to use a 96-bit nonce, which can be generated either randomly or deterministically. If you use a nonce that isn't 96 bits then it is padded and hashed with GHASH to create a ...
37
votes
1answer
29k views

How to choose between AES-CCM and AES-GCM for storage volume encryption

We are using the encryption built into Solaris 11 ZFS, which offers the choice between CCM (CBC counter mode) and GCM (Galois counter mode). What are the pros and cons of choosing each of these cipher ...
1
vote
1answer
100 views

Safe way to derive IV from the DH shared keys for AES-GCM?

I am preparing to use AES-GCM to make a secure communication program. Here is the procedure DH key exchange to get shared keys SHA256(shared keys) Use AES-GCM to encrypt a message while the key only ...
0
votes
1answer
59 views

Does Camellia-GCM use Camellia-CTR to create GCM Hash?

I'm still confused when reading GnuTLS/Nettle implementation about Camellia-GCM.
5
votes
1answer
1k views

Why is the GHASH output in GCM mode encrypted to calculate the tag?

To calculate the authentication tag in the Galois/Counter mode (GCM), first a MAC is calculated using GHASH over the cipher text and the additional data. After that, this MAC is encrypted using GCTR (...
1
vote
2answers
231 views

Can an AES-GCM be cracked if the key is known but the nonce isn't?

I'm kind of new in this field and I've been trying to learn it. I'm now facing an issue where I have a couple of packages encrypted with AES-128 GCM and I have the key that was used to encrypt these ...
5
votes
1answer
94 views

Line by line encrypted logging stored with iv/salt/iterations. How safe is it?

I'm building an encrypted logging application. Log entries are encrypted with AES-256-GCM, using password-derived keys with PBKDF2. The application must support log rotation, and I would like to make ...
6
votes
3answers
631 views

Nonce-misuse-resistance scheme applied after the fact to AES-GCM for defense in depth?

This is a follow-up to a previous question about encrypting IV/MAC results from AEAD ciphers. I have a system I'm working on that needs to use standard (NIST/FIPS) cryptography, at least for its ...
0
votes
0answers
50 views

Can I use aes-gcm to authenticate a user based on his ability to decrypt a payload?

I'd like to authenticate my users without storing their password, even in a derived form with scrypt/pbkdf or other derivation methods. I'm exploring the idea of encrypting a random payload with AES ...
1
vote
2answers
131 views

With AES-GCM, may I use multiple tags per key?

In my implementation of AES-GCM, the key might change only once per minute. However, I wish to calculate a new tag every 6us, to reduce latency (since you have to buffer up a GCM "packet" before ...
1
vote
1answer
102 views

Can I make fixed-length ciphertext with AES-256-GCM?

I have a question about AES-256-GCM encryption. Can I make a fixed-length encryption output? In my understanding, I cannot make a fixed-length ciphertext. To me, the fixed-length output is much more ...
2
votes
0answers
17 views

Does the size of data to be encrypted influence the security of Gmac?

In this link: Has GMAC mode a future outside GCM?, the last comment given by the user Demi, indicates that the larger the size of the text to be encrypted, the lower the security of the gmac. Why is ...
2
votes
1answer
77 views

Is it safe to generate GCM/GMAC intermediate tags?

I would like to use GCM/GMAC in next manner: abcd|Tag0|efgh|Tag1|ijkl|Tag2| ... |wxyz|TagN The nuance is each tag I gonna generate is not from its last block but ...
7
votes
2answers
628 views

OCB and GCM security

Is OCB as secure as GCM or CCM ? Since OCB design is quite different from GCM and CCM, I was wondering if the security properties of these latters are satisfied by OCB, as well.
2
votes
2answers
121 views

Is this correct/incorrect password for file encryption scheme secure?

I'm writing an AES file encryption program, and I'd like to put in a way to tell whether or not the user has entered the correct password without decrypting the entire file and GCM telling me the tag ...
2
votes
2answers
3k views

AES-256 GCM IV guidelines

If I use for example AES-256 (GCM), and my message is bigger than 256 bit (broken into smaller 256 bit blocks for encryption), should the IV change for every 256 bits of the message?
2
votes
1answer
10k views

AES CBC Security

I am building an Apache webserver with TLS 1.2 and OpenSSL 1.0.1. So far, I have enabled 2 encryption algorithms - ECDHE AES-256 GCM and ECHDE AES-128 GCM. Firefox and Chrome / Chromium use NSS which ...
1
vote
0answers
129 views

AES-GCM - what are “Payload Length” and “AAD Length”

For the AES-GCM mode within many cryptomodules, their FIPS-validation certificates list the options: Payload Length: 504, 512, 1016, 1024 AAD Length: 0, 504, 512, 1016, 1024 For example in OpenSSL, "...
36
votes
2answers
25k views

Practical disadvantages of GCM mode encryption

It seems that GCM mode encryption has a clear advantage over CBC + HMAC in the sense that it only requires a single key. But it seems that there are some experts here that do not trust it enough to ...

1
2 3 4 5 6