Questions tagged [gcm]

The Galois Counter Mode, an authenticated encryption mode of operation for a block cipher.

Filter by
Sorted by
Tagged with
3
votes
1answer
200 views

GCM mode GHASH sensitivity to timing attacks

In GCM mode of authenticated encryption, is it a security concern if the GHASH implementation timing can vary? If the timing varies according to the AAD/ciphertext data, it looks as though that doesn'...
3
votes
2answers
189 views

GCM mode and the order of AAD and plaintext

In GCM mode of encryption, what are the limitations on the mixing of plaintext and AAD (additional authenticated data)? Must the AAD come before the plaintext? Or could it be after the plaintext ...
3
votes
2answers
199 views

Generate $J_0$ for GCM cipher when $\operatorname{len}(IV) \neq 96$ bits

I have the following questions about the construction of J0 when is not equal to 96 bits, $s= 128\big\lceil \operatorname{len}(\text{IV})/128\big\rceil-\operatorname{len}(\text{IV})$ For example if ...
3
votes
0answers
122 views

How to break GCM that uses the same IV

I have an implementation that natively uses the same IV (12 bytes of 0) for all encryption. The key is always a 32 byte SHA-512 hash. I know via this post that I ...
1
vote
2answers
130 views

Does GHASH use XOR or addition?

I've been looking into GHASH and some sites describe it as a polynomial: A1*(H* *M-1)+A2*(H* *M-2)...C1*H(H* *M-N)+C2*H(H* *(M-N-1))...+len(A||C)*H+E(0)=t while ...
2
votes
1answer
2k views

AES-CBC then SHA vs AES-GCM for encrypting and authenticating a web token

I am trying to have something like JWT but kinda ad hoc and encrypted. The token itself is simply a stringified JSON that contains the user ID and Unix timestamp. Now, I tried to use AES-128-GCM, ...
3
votes
1answer
559 views

Do aes_256_gcm IVs just need to be unique for that key?

I'm using GCM (via openssl's EVP_EncryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL))). The IV's default length is 12 bytes. It says that the IV must be ...
2
votes
2answers
251 views

Does AES-GCM without security tag turn into regular CTR Mode?

We are looking to implement a simple password based key agreement scheme. Part of this is deriving a symmetric key from a common passphrase known to both parties involved. This symmetric key is then ...
2
votes
1answer
649 views

Would it be safe to store GCM nonce in the encrypted output?

I'm looking to use AES-256 GCM to encrypt and authenticate a file containing sensitive information. I am a bit loss on where to store the nonce that is required for GCM. Would it be adequate/safe to ...
1
vote
1answer
50 views

GCM cipher M0 tables : semantic questions on how to implement GCM

I`m reading the PDF "The Galois/Counter Mode of Operation (GCM)". In section 4.1 on the optimization of multiplications with tab, in algorithm 3 I have the following questions: A vector called M with ...
0
votes
1answer
658 views

MAC size 128 bits or more?

Just a quick question: I've seen implemented BouncyCastle's class AeadParameters with MAC length of 128 bits, which was allegedly recommended. Though when I looked up HMac to implement my own MAC in ...
4
votes
2answers
388 views

Is it possible to recover AES-GCM plaintext when having everything but the additional data?

I'm using the window.crypto library in browsers. I use iv from window.crypto.getRandomValues...
1
vote
1answer
51 views

Does GCM need to incorporate the length of the associate data and the length of the ciphertext to be secure?

What is the reason for incorporating the lengths of the associated data and ciphertext into the calculation of the authentication tag in GCM? Is it for security?
7
votes
2answers
744 views

IV in Galois Counter Mode

I am looking at Wikepedia Galois Counter Mode article. I see this diagram I am trying to figure out where the IV works its way in. Is it used to initialize the counter? If so, how does a sequence of ...
10
votes
1answer
230 views

AES cache-timing attacks and nonce-based operation modes

As I understand it, AES cache-timing attacks exploit the execution time variations due to cache hits/misses, especially the ones depending on the SBox look-up tables which are key-related. To mount ...
0
votes
0answers
73 views

Using OpenSSL to emulate LTO 4 tape encryption

I have a mix of LTO 4 and LTO 3 tapes I would like to encrypt data on to. LTO 4 has built in encryption - load they key into the drive, and it handles the AES-256-GCM encyption transparently. LTO 3 ...
0
votes
1answer
143 views

Why not generate the authentication key from the key and nonce in GCM?

In Galois/counter mode, the authentication key $H$ is leaked if two distinct messages are encrypted using the same nonce. If someone did end up doing that, then they would need to rekey to get a new $...
6
votes
1answer
132 views

Is this a typo/error in the Galois/Counter mode specification or have I misunderstood?

I've been reading the following document describing Galois Counter Mode: The Galois/Counter Mode of Operation On page 7 of the document, the following diagram describes the ...
1
vote
1answer
476 views

Is GCM mode of authenticated encryption quantum secure?

Regarding post-quantum symmetric cryptography, it has been recommended to move to AES-256 or similar ciphers with 256-bit keys. How is authenticated encryption affected? Is AES-256-GCM considered ...
2
votes
1answer
92 views

GCM and decrypting with Krack

I'm trying to understand how Krack works on GCM. I thought that looking at GCM would be easier since it's a full break and the video shows a tool that is able to decrypt everything. I see that the IV ...
1
vote
1answer
260 views

Is the nonce in GCM mode used as key for HMAC? And how to send it?

So, my believe is that, in some way, GCM mode or any other authenticated encryption mode is useful to provide encryption and integrity for the ciphertext altogether instead of having to handle the ...
6
votes
1answer
365 views

Security of GCM if Implemented with Stream Cipher instead of Block Cipher

Can GCM be implemented with a stream cipher instead of a block cipher? If no, then what security flaw does it have? If yes, then which possibility from below two is better in terms of security? In ...
6
votes
2answers
493 views

Are tags longer than 128 bit possible for AES-256-CCM and AES-256-GCM?

I have an existing application that uses AES-256-CBC for encrypting data blocks, and HMAC-SHA-256 on the plaintext for eliminating duplicate data blocks. For performance reasons, I would like to move ...
-1
votes
1answer
1k views

AES GCM in swift 3 [closed]

I have an API which needs data encripted using AES/GCM/NoPadding. But in various posts in the internet I have read that apple has removed the GCM from the common crypto library. Could any one tell a ...
1
vote
2answers
224 views

The purpose of ADATA in GCM

I have a hard time understanding the purpose of ADATA in GCM algorithm. Is ADATA the plaintext itself we would like to encrypt or is it some random data as for the IV ? Otherwise from what I have ...
0
votes
1answer
209 views

Do I need to worry about the IV if I use a 32 byte random salt with SCrypt and AES-GCM?

I am encrypting a DEK (data encryption key) with a KEK (key encryption key). The KEK is generated from a password using scrypt with default parameters and a 32 byte randomly generated salt. The ...
2
votes
1answer
272 views

AES mode which verifies data integrity AFTER decryption

I wonder if there is an AES mode which would verify data integrity after decryption operation. Due to the reasons which does not matter here, there is a possibility that AES implementation I use may ...
3
votes
1answer
393 views

Is it a vulnerability (for message authentication) to have a variable iteration-count for PBKDF2?

The scenario: A user clicks on an encrypted file, and enters his password, in order to decrypt and authenticate it using HMAC (when its key is derived using PBKDF2). If the iteration-count is fixed, ...
1
vote
0answers
143 views

Can we use different mode for decryption instead of using mode which is used in encryption? [closed]

I am decrypting the Apple Payment Token in Demandware, the apple pay token is encrypted in GCM mode, but in Demandware, we don't have GCM mode in Cipher class, so can I use other modes for decryption? ...
10
votes
1answer
1k views

How was the GCM polynomial found?

As far as I understand, there is no general way to enumerate irreducible polynomials in a particular finite field, which are similar in nature to prime numbers over the integers. The GCM mode finite ...
1
vote
1answer
85 views

Is creating an authentication-key (mac) from the encryption password a vulnerability?

I can think of at least one problem with it - that testing for a correct key (when brute forcing) is simpler with a mac key (at least for short messages) and therefore can help brute force decryption.
3
votes
1answer
200 views

Can I derive an IV as a segment counter for AES256-GCM?

I'm writing a software that will be encrypting & authenticating segments of data, each 4096 bytes long. These segments are saved to disk in a sequential order that will never change. So I was ...
9
votes
2answers
1k views

GCM as a general purpose cryptographic hash?

Why are hash functions (e.g SHA-3) so complicated when GCM apparently provides secure hashing and has a relatively simple construction? Is this purely about speed? I imagine that GMAC with a fixed ...
1
vote
1answer
1k views

What's the maximum length for AAD in GCM?

...
0
votes
1answer
313 views

PBEWithHmacSHA512AndAES_128 and AES Modes like GCM [closed]

I've asked this question on stackoverflow And I think one gentleman has already answered the first part of question a) In my code i am keeping IV and salt with ciphertext. I wanted to use ...
2
votes
1answer
2k views

AES-GCM — what is ICV and what happens if I don't use it

I am interested in using AES-GCM and after hours of reading on Internet I still have a few questions: What will ensure the ICV, is it only Integrity ? If I don't need it on my purpose, can I spare it ...
3
votes
1answer
993 views

Why is the GHASH output in GCM mode encrypted to calculate the tag?

To calculate the authentication tag in the Galois/Counter mode (GCM), first a MAC is calculated using GHASH over the cipher text and the additional data. After that, this MAC is encrypted using GCTR (...
7
votes
1answer
2k views

Relationship between AES GCM and AES CTR

I have read that AES GCM uses AES CTR for encryption and GMAC for authentication. If that is correct, what is the relationship between the IV used for AES GCM and the IV used for AES CTR? TO put the ...
2
votes
0answers
204 views

Conforming to best practices in password file (keyring) encryption

In order to implement a plaintext password file safe (keyring), while adhering to best Crypto practices today, I came up with this scheme: A user's master password is hashed with Argon2 (\$argon2id\$...
7
votes
2answers
1k views

Why does AES-GCM not require an auth key, but encrypt-then-mac does?

The inputs to AES GCM mode appear to be: an IV a key message to encrypt The output is a cipher and auth tag. However, if one were to manually perform an encrypt-then-mac scheme, the inputs required ...
8
votes
1answer
148 views

How to implement “online” feature of GCM?

I've heard that Galois Counter Mode (GCM) is an "online" encryption algorithm—it is not necessary to know the size of the input ahead of time. But does GCM require that all authenticated-but-not-...
8
votes
1answer
4k views

What is a safe maximum message size limit when encrypting files to disk with AES-GCM before the need to re-generate the key or NONCE

The general limits from the NIST recommendation are as follows: Maximum Encrypted Plaintext Size ≤ 239 - 256 bits; Maximum Processed Additional Authenticated Data ≤ 264 - 1 bits; This stack ...
2
votes
1answer
580 views

Can I use a deterministic NONCE for AES-GCM file encryption if I generate “fresh” keys for each encrypted file

The NIST specification states that the deterministic NONCE(IV) should be 96 bits. It should consist of two fields: fixed field of 32 bits and a 64 bit counter. The use of a random 96 bit NONCE is ...
5
votes
2answers
349 views

implementing GCM with dev/urandom for a nonce

I'm currently trying to integrate GCM into my code, and I have just enough knowledge to know I'm probably doing this wrong. I know for GCM and other CTR like ciphers, using the same key with the same ...
4
votes
1answer
325 views

Storing a Secure Boot image with AES-GCM instead of AES + RSA signature

In Secure Boot (here defined as data is encrypted and authenticated), we can encrypt the data with AES-128 and authenticate it with a RSA signature, computed over the data's hash, afterwards. On boot,...
9
votes
2answers
787 views

Are lookup tables safe when they fit in a cache line?

The typical cache line size of modern x86 machines is 64 bytes. Is it safe to use lookup tables with secret data if the table does not exceed the cache line size, and is aligned accordingly? I was ...
3
votes
1answer
805 views

Poly1305-AES vs AES-GCM

What are the advantages of Poly1305-AES over AES-GCM? Please note I am not talking about chacha20-Poly1305 that has been widely adopted, including by Google. But I would like to know pros and cons ...
5
votes
1answer
2k views

Safety of random nonce with AES-GCM?

I am encrypting multiple messages using a 256 bit key with AES in GCM mode, generating a random 96 bit nonce for each message. The small nonce size combined with random values is worrying me: AES-...
5
votes
1answer
5k views

GCM padding or not?

In this question on StackOverflow https://stackoverflow.com/questions/31248777/can-pkcs5padding-be-in-aes-gcm-mode it's said that GCM doesn't require a padding: why?
3
votes
1answer
2k views

How to choose the size of the IV in AES-GCM?

In The Galois/Counter Mode of Operation (GCM) by McGrew and Vega (PDF) it's stated that: An initialization vector IV , that can have any number of bits between $1$ and $2^{64}$. For a fixed value ...