Questions tagged [gcm]

The Galois Counter Mode, an authenticated encryption mode of operation for a block cipher.

Filter by
Sorted by
Tagged with
71
votes
1answer
123k views

What is the difference between CBC and GCM mode?

I am trying to learn more about GCM mode and how it differs between CBC. I already know that GCM provides a MAC which is used for message authentication. From what I have read, and from the code ...
33
votes
2answers
22k views

Practical disadvantages of GCM mode encryption

It seems that GCM mode encryption has a clear advantage over CBC + HMAC in the sense that it only requires a single key. But it seems that there are some experts here that do not trust it enough to ...
30
votes
1answer
54k views

AES256-GCM - can someone explain how to use it securely (ruby)

I am looking into using AES256-GCM for encrypting some database fields. I know that for AES256-CBC, I need to generate a new IV for each encrypt, but I can use the same key. The IV can be openly ...
24
votes
2answers
4k views

AES-GCM Disadvantage

What is the disadvantage of AES-GCM mode for authenticated encryption? Why does the CAESAR competition say that it’s one of the goals to find an AE scheme that offers an advantage over AES-GCM? What ...
24
votes
1answer
21k views

How to choose between AES-CCM and AES-GCM for storage volume encryption

We are using the encryption built into Solaris 11 ZFS, which offers the choice between CCM (CBC counter mode) and GCM (Galois counter mode). What are the pros and cons of choosing each of these cipher ...
23
votes
1answer
19k views

Ciphertext and tag size and IV transmission with AES in GCM mode

I am completely new to using AES in GCM mode of operation, and I have not a very large background in cryptography as well. I have been playing with OpenSSL trying to encrypt and decrypt some messages. ...
23
votes
2answers
2k views

Is GCM still recommended?

I stumbled across a forum thread where security researcher Thomas Ptacek seemed to have negative feelings towards GCM. I had always thought from prior readings that GCM was the current gold standard ...
20
votes
2answers
2k views

Is (AES-)GCM parallelizable?

I recentely faced the issue of random access decryption while AES-GCM was being used. I said this person that the underlying CTR should allow parallelization but I have no idea how authentication ...
19
votes
3answers
4k views

Plain text size limits for AES-GCM mode just 64GB?

Based on NIST SP 800-38D section 5.2.1.1, it seems that the maximum length of plaintext is 2^39-256 bits ~ 64 GB. We've got 100+GB files in genomics that need to be GCM encrypted so are concerned ...
17
votes
2answers
7k views

Does AAD make GCM encryption more secure?

Does additional authenticated data (AAD) make AES GCM encryption more secure? What if we drop AAD in AES-GCM 256? If we drop it, how will it make the encryption less secure?
17
votes
2answers
8k views

AES-GCM recommended IV size: Why 12 bytes?

When using AES-GCM, a 96-bit IV is generally recommended. Most implementations I've seen also use 96-bit. However, I'm unsure on where this recommendation or convention comes from. Let's assume a ...
14
votes
3answers
18k views

AES-GCM and its IV/nonce value

I was reading about the differences between the GCM and the CBC more here and I have a follow up doubt on the same. In the CBC mode the person who performs the encryption is the one who provides the ...
14
votes
1answer
6k views

GCM vs CTR+HMAC tradeoffs

So these days I see everyone using AES-GCM. What are its advantages over simple CTR+HMAC modes? Is it speed? Or ciphertext length? And what are the security tradeoffs, both in terms of practical ...
12
votes
1answer
2k views

Windows 8/Server 2012: Passes FIPS-140-2 despite failing AES-GCM for IV != 96 bits long?

Background Microsoft certifies Windows 7/8 as well as Server 2008 R2 and 2012 to be FIPS-140-2 compliant. Actually they certify just a small crypto core, bcrypt.dll (the library, which is unrelated ...
11
votes
2answers
8k views

AES GCM vs other encryption modes in embedded environment for network traffic

I'm doing a lot of research since I'm doing an internship for a company where I need to upgrade their security level. Their own protocol needs a cryptographic upgrade and I'm leaning towards AES since ...
10
votes
1answer
1k views

How was the GCM polynomial found?

As far as I understand, there is no general way to enumerate irreducible polynomials in a particular finite field, which are similar in nature to prime numbers over the integers. The GCM mode finite ...
10
votes
2answers
4k views

How bad it is using the same IV twice with AES/GCM?

I understand that initialization vectors (IV) should not be used twice when using AES/GCM. I am using a counter as an initialization vector. Every time I send out a new packet (I am developing an UDP ...
10
votes
1answer
3k views

Does the GCM authentication tag need to be protected?

I am just learning about the GCM mode of AES and I'd like to start using it in my software. However, I have a question about its use. As I understand it the output of a GCM encryption operation is ...
10
votes
1answer
230 views

AES cache-timing attacks and nonce-based operation modes

As I understand it, AES cache-timing attacks exploit the execution time variations due to cache hits/misses, especially the ones depending on the SBox look-up tables which are key-related. To mount ...
9
votes
1answer
277 views

how does BearSSL's GCM modular reduction work?

BearSSL (in src/hash/ghash_ctmul.c) seems to be doing a modular reduction that I don't completely understand. Here's the code: ...
9
votes
2answers
1k views

GCM as a general purpose cryptographic hash?

Why are hash functions (e.g SHA-3) so complicated when GCM apparently provides secure hashing and has a relatively simple construction? Is this purely about speed? I imagine that GMAC with a fixed ...
9
votes
2answers
4k views

Leaving authentication data blank less secure for AES GCM?

The AES GCM example for Ruby / OpenSSL shown at: http://ruby-doc.org/stdlib-2.0/libdoc/openssl/rdoc/OpenSSL/Cipher.html has a GCM example of the following: ...
9
votes
2answers
787 views

Are lookup tables safe when they fit in a cache line?

The typical cache line size of modern x86 machines is 64 bytes. Is it safe to use lookup tables with secret data if the table does not exceed the cache line size, and is aligned accordingly? I was ...
9
votes
1answer
8k views

Where is the authentication tag stored in file encrypted using AES-GCM?

So I am using cryptopp to encrypt a file in a project and I am using AES-GCM. I have a 256bit key and a 128bit ivec and a 128bit tag that I use to encrypt files. However, I want to know where the ...
9
votes
1answer
120 views

GCM mode of operation with long-term keys

Regarding GCM, NIST specifies the following: The total number of invocations of the authenticated encryption function shall not exceed $2^{32}$, including all IV lengths and all instances of the ...
8
votes
3answers
1k views

Can a zero nonce be safely used with AES-GCM if the key is random and never used again?

I could generate a random nonce and prepend it to the ciphertext, but storage space is at a premium and the only constraint AES-GCM has on the nonce (if I'm reading correctly) is that the same nonce ...
8
votes
1answer
150 views

How to implement “online” feature of GCM?

I've heard that Galois Counter Mode (GCM) is an "online" encryption algorithm—it is not necessary to know the size of the input ahead of time. But does GCM require that all authenticated-but-not-...
8
votes
1answer
4k views

What is a safe maximum message size limit when encrypting files to disk with AES-GCM before the need to re-generate the key or NONCE

The general limits from the NIST recommendation are as follows: Maximum Encrypted Plaintext Size ≤ 239 - 256 bits; Maximum Processed Additional Authenticated Data ≤ 264 - 1 bits; This stack ...
8
votes
0answers
244 views

Unique GCM/CCM initial counters without recipient side message counters

I am implementing the encryption layer for a communication protocol. The bulk encryption method used is either AES-CCM or AES-GCM. Due to implementation details, encryption of packets is usually, but ...
7
votes
2answers
1k views

Why does AES-GCM not require an auth key, but encrypt-then-mac does?

The inputs to AES GCM mode appear to be: an IV a key message to encrypt The output is a cipher and auth tag. However, if one were to manually perform an encrypt-then-mac scheme, the inputs required ...
7
votes
1answer
2k views

TLS 1.2 Cipher Suites With AES-GCM – What data (if any) is passed to the AES-GCM cipher as the Additional Authentication Data?

TLS 1.2 defines a number of cipher suites that employ AES-GCM, e.g.: ...
7
votes
2answers
744 views

IV in Galois Counter Mode

I am looking at Wikepedia Galois Counter Mode article. I see this diagram I am trying to figure out where the IV works its way in. Is it used to initialize the counter? If so, how does a sequence of ...
7
votes
2answers
10k views

Encryption of big files in Java with AES/GCM

I have to encrypt big files. Say their size ranges from 500mb to several of gigabytes. I would like to use AES/GCM/NoPadding as provided by Java 1.8 since that gives me automatic authentication and ...
7
votes
1answer
2k views

Relationship between AES GCM and AES CTR

I have read that AES GCM uses AES CTR for encryption and GMAC for authentication. If that is correct, what is the relationship between the IV used for AES GCM and the IV used for AES CTR? TO put the ...
7
votes
1answer
2k views

Has GMAC mode a future outside GCM?

Once gcm has been implemented for providing both encryption & authentication solution , it appears obvious to consider that such implementation can also provide (if required by new user) a Mac ...
7
votes
1answer
956 views

What are the constraints on using GCM with a tag size of 96 and 128 bits?

Say we want to use AES (or any other secure 128 bit block cipher) with GCM and a tag size of 96 or 128 bits. I'm assuming an AES key size of 128 bits and an IV size of 96 bits (the default). NIST SP ...
7
votes
1answer
381 views

Detection of weak keys for AES-GCM

There are many papers out there that show that a message authenticated and encrypted by AES-GCM can be forged if the used key is weak (e.g. by Handschuh and Preneel, Saarinen or Procter and Cid). With ...
7
votes
1answer
405 views

OCB and GCM security

Is OCB as secure as GCM or CCM ? Since OCB design is quite different from GCM and CCM, I was wondering if the security properties of these latters are satisfied by OCB, as well.
7
votes
0answers
136 views

GCM with reversed poly

These slides talk about how GCM can be sped up if one uses $x^{128}+x^{127}+x^{126}+x^{121}+1$ as the reduction polynomial instead of $x^{128}+x^7+x^2+x^1+1$. When one is doing that one needs to ...
6
votes
1answer
4k views

How can there be AES-256-GCM, when GCM is defined for 128-sized blocks?

In both node.js and OpenSSL, I am seeing cipher "aes-256-gcm". However, in NIST Special Publication 800-38D, that defines GCM, I am reading: The underlying block cipher shall be approved, the ...
6
votes
1answer
7k views

How much is slower GCM AES-128 than one of the stream chipher eSTREAM?

Evaluate the speed of the algorithm GCM AES-128 and compare it whith speed of one of the stream chipher in eSTREAM. Can someone give such an assessment?
6
votes
1answer
925 views

What is the purpose of the “Explicit Nonce” in TLS for AES-GCM and AES-CCM?

TLS uses an explicit (secret) 32-bit nonce in combination with the 64-bit sequence number to create the IV for AES-GCM and the nonce for AES-CCM. However, I wonder why TLS needs the explicit nonce. ...
6
votes
1answer
4k views

Why does AES-GCM need a hash/MAC in TLS?

"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" is just one example for a cipher suite, as far as I'm concerned it means this: It uses the TLS protocol, exchanges keys with Elliptic Curve Diffie Hellman ...
6
votes
2answers
427 views

HMAC - What does “in transit” mean

I often read that MAC's provide a proof of authenticity of a payload 'in transit'. I'm wondering though is there any special definition of "in transit" that would prevent it from being reliable over ...
6
votes
2answers
4k views

Using GMAC for Authentication without encrypting the message

I am pretty new to cryptography and have a sample of GCM mode of operation for AES. PFB the code ...
6
votes
1answer
755 views

Useful additional data to employ in GCM

Are there any requirements for the additional data to be used in the GCM block cipher mode? And are there any "classic" used informations worthwile to be used? Can for example a username or the name ...
6
votes
2answers
849 views

Security of encrypting many short values with AES in GCM mode

We intend to encrypt certain values in a database which holds personal information such as addresses so as to prevent data leakage should the database be compromised. The intention is that each field ...
6
votes
1answer
3k views

How to use GCM mode and associated-data properly

I'm currently migrating a project to use the bouncy castle GCM mode. I understand that using an authenticated mode removes the need for a HMAC, however I want to be sure that I'm using this mode ...
6
votes
1answer
2k views

Nonce for AES GCM to prevent replay attacks

I am wanting to encrypt a message with a pre shared key that uses AES GCM from the OpenSSL library to do so. I generate my key for the AES crypto via hashing my pre shared key with a salt using the <...
6
votes
1answer
254 views

Do Carter–Wegman MACs allow key reuse if the MAC tag is kept secret?

Poly1305 (and GHASH) are secure authenticators, but only for one use. Thus, nonce reuse in Poly1305-AES, ChaCha20-Poly1305, and AES-GCM all reveal the authentication key. However, my understanding ...