Questions tagged [gcm]
The Galois Counter Mode, an authenticated encryption mode of operation for a block cipher.
307
questions
0
votes
1
answer
88
views
+100
Row level database encryption scheme
I am developing a row level database encryption scheme. Ideally I would not do this and instead rely on something vetted, but I haven't been able to find such a scheme online.
My primary concerns are:
...
- 1
5
votes
1
answer
220
views
What best to put in unused nonce bytes when using AES-GCM-SIV
I want to use AES-GCM-SIV for authenticated encryption of messages in my protocol.
Since it is a wireless protocol I want to transmit as few bytes as possible. For successful decryption I need to ...
- 151
3
votes
1
answer
148
views
High volume encryption with AES-GCM: AWS KMS vs CloudHSM
In my current project we will have to encrypt a lot of S3 objects (a few billions) with AWS KMS.
Our security department requires that we use KMS keys backed by CloudHSM. But since CloudHSM incurs ...
- 31
1
vote
1
answer
126
views
Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit, why Not 2^39 [duplicate]
While examining the initial GCM specification by McGrew and Viega in 2005, it appears that the formation of the 128-bit Initialization Vector by combining a 96-bit nonce and a 32-bit unsigned wrapping ...
- 21
0
votes
0
answers
152
views
AES-GCM with a fixed IV but a random "wrapped" key
It is well-known that AES-GCM requires the IV to be unique for each message that is encrypted with the same key. If the IV ever repeats, with the same key, then AES-GCM fails catastrophically. Now, ...
4
votes
2
answers
483
views
Key commitment in GCM (or AEAD in general)
Many of the presentations at The Third NIST Workshop on Block Cipher Modes of Operation 2023 complain about the lack of key commitment in AES-GCM.
But isn't that one application of "associated ...
- 421
0
votes
0
answers
88
views
Is it possible to uncover the plaintext if IV is used twice but the key is different?
I am currently working on a cryptography challenge. The program uses AES-GCM to encrypt and decrypt strings.
Let's say I have the following:
IV which is reused
only 1 cipher text
authentication tag
...
- 101
0
votes
0
answers
48
views
Encrypted Alert21- Error code 214
I am working on TLS 1.2 Cipher TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, After send the application data server throws an error message ...
1
vote
1
answer
84
views
Newbie question about AES-GCM and IV
Imagine a channel where the initial secret for deriving of the actual key is established with ECDH.
First, that shared secret is used to derive a temporary key with some default parameters (salt, ...
- 113
1
vote
1
answer
91
views
DTLS 1.2 Cipher Suites With AES-GCM – What data (if any) is passed to the AES-GCM cipher as the Additional Authentication Data?
It is DTLS 1.2 version question of this question.
I know from 4.1.2.4. of RFC 5246 (DTLS 1.2) AEAD Ciphers can be used in DTLS 1.2 exactly the same with TLS 1.2.
In TLS 1.2
AAD = seq_num + ...
- 13
1
vote
1
answer
557
views
How does AES-GCM and AES-CCM provide authenticity?
My lecture notes state that of the AES operating modes ECB, CBC, CTR, CCM (CTR+CBC MAC) and GCM, only CCM and GCM provide authenticity.
In CCM, as I understand it, the authenticity lies in the MAC, i....
- 21
3
votes
1
answer
113
views
What kind of hashing is GF multiplication in GCM cipher mode and GMAC?
In GCM, GMAC, the additional associated data (AAD) (as well as outputs of subsequent blocks) is multiplied by a polynomial H in GF(2^128). This appears to be doing some secure hashing.
Is that what's ...
- 117
1
vote
2
answers
1k
views
AES-GCM and tag length
Due to protocol limitations, I can put in 24 bytes of data only for tx (excluding headers), if I use AES_GCM for encrypting my data, I understand I don't need to worry about padding.
For instance, if ...
2
votes
1
answer
336
views
Is it possible to reverse GHASH from GCM?
How can I create a "reverse" GHASH algorithm for GCM that allows me to compute an input value that generates a specific chosen output, given that I know the authentication key H? If this is ...
- 29
4
votes
2
answers
2k
views
OpenSSL AES-GCM says 'bad decrypt', other block modes work fine?
If I do a simple encrypt and decrypt test like so:
...
- 1,387
1
vote
0
answers
1k
views
BAD Record MAC error from the server [closed]
I am working on ssl client because of some server update I was enabling the cipher TLS_DHE_RSA_WITH_AES_128_GCM_SHA256. While handshake with server I was facing Bad Record MAC Alert message from the ...
3
votes
2
answers
394
views
Why the polynomial of GCM is primitive?
I'm interested on the polynomial used in GCM-mode : $X^{128}+X^7+X^2+X+1$
This polynomial is Primitive (in $\mathbb{F}_2$).
What is the interest of choosing a primitive polynomial and not a simple ...
- 2,595
0
votes
2
answers
2k
views
Why GCM is used more often than CTR?
I've seen (on Wikipedia) in the more recent version of TLS, the Counter-mode was not used. But the Galois-Counter-mode was used?
What is the advantage to use the GCM instead of using the Counter-mode?
- 2,595
5
votes
3
answers
971
views
Is 'authenticated' in AEAD actually authentication? Or is it message integrity?
Despite working with AES-GCM and other AEAD algos for a few years, I've struggled with the concept of 'authenticated' in the term 'AEAD'. In my own experience (of Unix, PKI and blockchain) ...
- 499
1
vote
1
answer
206
views
Is it normal that cypertext size can be smaller than IV when using AES-256-GCM?
I noticed that when using AES-256-CBC with a 128-bit IV, the ciphertext is always at least 16 bytes long (size of IV).
I also noticed that when using AES-256-GCM with a 96-bit IV, the ciphertext size ...
- 199
2
votes
0
answers
71
views
Secure option for (hybrid) encryption of a secret key using JWE
I want to encrypt a private key $sk$ (it's actually an RSA private key in PKCS#8 format) with another person's (and/or my) public key $pk_A$ for secure storage. With JWE, it is possible to use hybrid ...
8
votes
1
answer
1k
views
Would an encryption-only block cipher be useful at all?
I recently implemented AES block cipher, encryption side only, to be used in QUIC parsing (QUIC uses GCM mode). There are other modes than GCM that use only encryption: for example CTR, OFB, and CFB.
...
- 1,247
1
vote
1
answer
76
views
How does a GMAC in GCM not nullify the utility of a seekable decrypt-able stream
I have been looking at the Galois/Counter Mode (GCM) for stream encryption. I understand the idea that it's a stream cipher and so it can be encrypted one bit at a time by XORing with the key stream ...
- 113
1
vote
2
answers
933
views
Why does AES-GCM means No MAC key, instead of MAC key what they are going to use?
From RFC 5246, section 6.2.3.3: AEAD Ciphers:
AEAD ciphers take as input a single key, a nonce, a plaintext, and "additional data" to be included in the authentication check, as described in ...
- 49
1
vote
1
answer
354
views
Does deriving a key from a master key and then encrypting with AES-GCM increase the lifetime of the master key?
Suppose that we have a symmetric 256-bit master key, and we want to encrypt using AES-GCM with random IVs. I understand that with random IVs, the lifetime of the master key is 2^32 in order to conform ...
- 11
2
votes
1
answer
3k
views
Validating AES GCM authentication tag between two different implementations
I'm a bit confused on how to validate the authentication tag between two different AES GCM implementations.
One implementation (on my part) is in Java. The other, I don't know.
In my implementation, ...
- 23
1
vote
1
answer
292
views
Multiple Encryption Using GCM For Multi-Key Security
Multiple Encryption For Multi-Key Security
I have a hypothetical question about multiple encryption after reading Matthew Green’s blog on multiple encryption. For those who are familiar with GCM…I ...
- 11
2
votes
1
answer
983
views
How is TLS 1.3 application data encrypted with AES-GCM sent 'over the wire'?
I've been trying to manually decrypt some TLS 1.3 traffic for educational reasons, and have stumbled across a roadblock. So far, I've been able to complete most of the key schedule, including deriving ...
- 161
1
vote
1
answer
496
views
Performance of AES CTR + HMAC SHA1
I'm doing a performance test on AES with CTR mode and HMAC SHA1 for message authentication and found the openssl speed tool for that.
I run multiple tests with <...
- 115
0
votes
1
answer
194
views
CTR HMAC SHA1 vs GCM Key management
The protocol SRTP uses by default AES in CTR mode with HMAC-SHA1.
For my thesis I want to research if GCM would be a better option.
Therefore I read following discussion.
There the answer was that GCM ...
- 115
1
vote
1
answer
123
views
Understanding the algebra behind GCM's security
I would like to understand the algebra behind GCM's security. Before I ask my questions, let me state my understanding of the math behind GCM. If correct, my questions are at the end; if incorrect, ...
- 135
4
votes
1
answer
1k
views
Java: SecureRandom.getInstanceStrong() vs new SecureRandom()
Given SecureRandom class is considered suitable for use in cryptography, I consider new SecureRandom() to be secure (funny term, ...
user80928
0
votes
1
answer
261
views
How to produce Auth Data and tag in GCM? Does MAC appended CTR mode encrypted text weaker than GCM?
In https://en.wikipedia.org/wiki/Galois/Counter_Mode, there's a diagram which tells us how GCM works in general.
I have watched computerphile video on how ECB,CBC and CTR mode works and able to ...
- 159
4
votes
1
answer
602
views
Is GCM with zero-length AAD less secure?
In a previous question, it was made clear that in the case of GCM, there is no distinction between "no AAD" and "zero-length AAD". Since I have noticed "zero-length AAD" ...
- 376
8
votes
2
answers
404
views
Lack of response to CAESAR competition
Why is there so little response (e.g. implementation in crypto libraries, programs...) after the end of the CAESAR competition? As far as I can see, there is no shift from AES-GCM to any of the CAESAR ...
- 995
1
vote
1
answer
207
views
Security level of Poly1305 and GMAC
The Libsodium docs list the AEAD forgery limits for ChaCha20Poly1305 and AES-GCM which seems like a < 128-bit security level but says that it's not a practical concern. I've seen other people say ...
- 13
2
votes
1
answer
127
views
How does Authentication-Key Recovery for GCM work?
In his Paper "Authentication weaknesses in GCM" Ferguson describes, how some bits of the error polynomial can be set to zero, thereby increasing significantly the chance of a forgery.
Q: ...
- 1,497
3
votes
1
answer
149
views
Factorization of polynomial in GF(2^128) used in GCM
It is widely known, that using a GCM nonce twice or even more often can be used to disclose the authentication key H. I understand, why this is theoretically possible. However, I have no feeling about ...
- 1,497
1
vote
1
answer
330
views
Why using same nonce (IV) twice voids confidentiality of plain text or even key?
I understand roughly (without details of GF algebra) the scheme of GCS/GMAC:
IV is to be put into Counter-0, so initializing counters.
It is known, that using a IV twice can not only reveal the plain ...
- 1,497
0
votes
1
answer
2k
views
AES-GCM can IV be stored alongside in DB?
I'm trying to encrypt and store strings in PHP as per example #1 on the PHP openssl_encrypt documentation.
...
- 103
1
vote
0
answers
858
views
How can I decrypt AES-256 GCM with key with a IV that is missing?
I want to decrypt a file that has been encrypted using AES-256 in GCM mode in libressl. I have the key but I don't have the IV, is there any way I can still decrypt?
- 11
2
votes
1
answer
79
views
Is it possible to do partial message authentication?
I want to authenticate part of a message, not all of it, while creating the MAC over the entire message. Let's say I create a 16B MAC over one hundred message blocks that are 64B each. Then I send one ...
0
votes
0
answers
725
views
Where to get AES GCM NIST-like test cases
I'm implementing AES GCM 256 bit at the moment. Now I'm finished with copying the content of the standard as a program and now have to make it actually work. With the test cases in the official NIST ...
- 101
0
votes
1
answer
68
views
Authentication in Lattice PQC candidates
I am looking into Authentication in lattice cryptography. Specifically in the NIST KEM finalists. I was specifically looking to see if there was a GCM (Galois counter mode) equivalence in the lattice ...
- 51
19
votes
5
answers
3k
views
AES GCM : is it acceptable to return the wrong plaintext if the tag is incorrect?
Let's start by saying I'm no cryptography expert, I'm just a developer, so feel free to correct me (using words, not downvotes) if what I'm saying is non-sense.
Context: I'm doing some crypto as a ...
- 293
1
vote
2
answers
2k
views
what is auth data in AES-GCM
I am trying to understand AES-GCM and I do not understand what I should transmit to Auth Data during encryption. What kind of data is that?
- 13
0
votes
2
answers
6k
views
AES/GCM/PKCS5Padding giving issues while AES/CBC/PKCS5Padding works fine for my use case
I have a requirement to read-encypt-save plus its reverse i.e. read-decypt-save files through chunk/block mechanism (single operation not feasible because of huge(GBs) file sizes).
So essentially the ...
- 101
0
votes
0
answers
22
views
Why does AES_GCM sometimes has a SHA for integrity? [duplicate]
For example the following suite:
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
From what I understand the SHA384 at the end is used to authenticate the message, which is exactly what MAC does, and the mode ...
- 11
6
votes
1
answer
565
views
How does GHASH used in GCM behave as a universal hashing function?
As per my understanding, a Universal Hash Function isn't a cryptographic hash function & it's output isn't uniformly distributed. However, this is still secure because it's actually a family of ...
- 2,211
3
votes
1
answer
142
views
What are the implications of allowing a zero-length GCM nonce?
NIST SP800-38D section 5.2.1.1 is clear that empty nonces are not allowed with GCM, but without explaining the reasoning. My assumption was this is simply because the probability of error (encrypting ...
- 1,694