Questions tagged [gcm]

The Galois Counter Mode, an authenticated encryption mode of operation for a block cipher.

Filter by
Sorted by
Tagged with
6
votes
1answer
5k views

GCM padding or not?

In this question on StackOverflow https://stackoverflow.com/questions/31248777/can-pkcs5padding-be-in-aes-gcm-mode it's said that GCM doesn't require a padding: why?
3
votes
1answer
2k views

How to choose the size of the IV in AES-GCM?

In The Galois/Counter Mode of Operation (GCM) by McGrew and Vega (PDF) it's stated that: An initialization vector IV , that can have any number of bits between $1$ and $2^{64}$. For a fixed value ...
6
votes
2answers
430 views

HMAC - What does “in transit” mean

I often read that MAC's provide a proof of authenticity of a payload 'in transit'. I'm wondering though is there any special definition of "in transit" that would prevent it from being reliable over ...
6
votes
1answer
785 views

Useful additional data to employ in GCM

Are there any requirements for the additional data to be used in the GCM block cipher mode? And are there any "classic" used informations worthwile to be used? Can for example a username or the name ...
4
votes
1answer
591 views

Properties provided by GCM

In the introduction of NIST Special Publication 800-38D is said that: GCM provides assurance of the confidentiality of data using a variation of the Counter mode of operation for encryption. GCM ...
3
votes
1answer
251 views

How does the GCM encryption limit affect TLS connections?

According to the Wikipedia article on Galois/Counter Mode, GCM is limited to encrypting $2^{39} − 256$ bits of plain text (64 GiB) for any given key and initialization vector. In light of this limit, ...
18
votes
2answers
8k views

AES-GCM recommended IV size: Why 12 bytes?

When using AES-GCM, a 96-bit IV is generally recommended. Most implementations I've seen also use 96-bit. However, I'm unsure on where this recommendation or convention comes from. Let's assume a ...
5
votes
1answer
730 views

Use Initializaiton Vector as Additional Authenticated Data

Cipher is GCM-AES. Is it acceptable/recommended to store the IV as AAD? Any popular examples?
4
votes
1answer
577 views

How does GCM/GMAC work?

My question is simple: where is a good article to learn how GCM/GMAC works? I mean not the description of the algorihm, but why this pair of algorithms for encryption/decryption is really inverse. For ...
3
votes
1answer
419 views

Can authenticated encryption reduce bandwidth overhead of per-packet encryption?

I know that authenticated encryption modes of operation like GCM offer certain security advantages, as well as increased performance. (On my laptop with AES-NI, the benchmark performance of ...
1
vote
1answer
290 views

Using SHA512 (or other hash) for message authentication

I need to encrypt and authenticate a stream of data so that it is resilient against unexpected power loss, so I cannot write authentication data at the end of the stream. I am currently using AES-GCM,...
3
votes
2answers
216 views

Can universal hashing functions be (ab)used as stream ciphers?

These days, universal hashing functions like GHASH and Poly1305 are very trendy because of their simplicity and speed. Now during a discussion related to export restrictions, it came up that mainly ...
3
votes
1answer
2k views

Minimum plaintext length for AES-GCM

In AES-GCM, from what i understand, the plaintext(as well as AAD and IV) bit length taken in must be a multiple of 8 (as specified by NIST Spes. Pub 800-38D). The AES-CTR however, doesn't "care" about ...
0
votes
1answer
603 views

is it possible to generate IV for a given block with AES GCM

So, I have a java CipherInputStream encrypted using AES/GCM/NoPadding (Bouncy Castle). I can decrypt the stream just fine with the IV (12 bytes) and the AES key. Is there any way I can decrypt the ...
2
votes
1answer
4k views

AES-GCM encryption and decryption doubts

I'm using AES-GCM mode in my project and I have some doubts. ...
2
votes
1answer
3k views

Why do the majority of SSL cipher suite used CBC?

I am looking at a wireshark capture of the cipher suites sent by my browser to the server during an SSL handshake; however, almost 90% of them use CBC, with 2 or 3 having GCM. Why is CBC most used? ...
6
votes
1answer
931 views

What is the purpose of the “Explicit Nonce” in TLS for AES-GCM and AES-CCM?

TLS uses an explicit (secret) 32-bit nonce in combination with the 64-bit sequence number to create the IV for AES-GCM and the nonce for AES-CCM. However, I wonder why TLS needs the explicit nonce. ...
2
votes
1answer
377 views

Authenticated Encryption with smallest Overhead (Input and Output)

I'm searching for the authenticated encryption algorithm that produces/requires the least overhead in total. This includes the authentication tag that it produces and the additional input that has to ...
7
votes
1answer
383 views

Detection of weak keys for AES-GCM

There are many papers out there that show that a message authenticated and encrypted by AES-GCM can be forged if the used key is weak (e.g. by Handschuh and Preneel, Saarinen or Procter and Cid). With ...
0
votes
2answers
316 views

What is the hash of this cipher: TLS_RSA_WITH_AES_128_CCM

In TLS 1.3 supported ciphersuite, I find the following ciphersuite: TLS_RSA_WITH_AES_128_CCM Can any one tell me what is the hash function used in this ciphersuite? how could you know that (...
0
votes
1answer
272 views

Is there a TLS extension for generating unique IVs for AES GCM?

Since reusing IVs is death for AES GCM, it seems like using the fixed IV in the TLS connection state is a phenomenally bad idea. It wouldn't even seem to be a good idea to use the salt + counter ...
1
vote
0answers
30 views

How long is the tag T in AES-GCM(Or: Can implementations freely choose t = len(T)?) [duplicate]

I've started to learn about GCM. In the paper I read on page 4 there is the equation: $$ T = \text{MSB}_t(\text{GHASH}(H, A, C) \oplus E(K, Y_0)) $$ It's clear to me that the function $\text{MSB}_t(S)...
1
vote
0answers
59 views

Authenticating a range of a ciphertext

I have some data that I CTR-AES-256 encrypt already. I am aware of ways to validate the integrity of the entire file (ie: a separate MAC of the plaintext, or encrypt then MAC, etc). But none of ...
6
votes
1answer
2k views

Nonce for AES GCM to prevent replay attacks

I am wanting to encrypt a message with a pre shared key that uses AES GCM from the OpenSSL library to do so. I generate my key for the AES crypto via hashing my pre shared key with a salt using the <...
18
votes
2answers
7k views

Does AAD make GCM encryption more secure?

Does additional authenticated data (AAD) make AES GCM encryption more secure? What if we drop AAD in AES-GCM 256? If we drop it, how will it make the encryption less secure?
1
vote
0answers
52 views

is Authentication tag always appended at last to ciphertext in AES-GCM 256? [duplicate]

I am using AES GCM 256 to encrypt/decrypt a UUID string,We are using java 7 + bouncy castle library for this,We are getting authentication tag of 128 bit ,i am confused ,whether it's position is ...
3
votes
2answers
2k views

Should I use XTS or GCM to encrypt my hard drives?

I want to start encrypting all of my hard drives, but I don't know whether to choose XTS or GCM mode. Why is it that XTS is recommended (since the most websites I visit use GCM in their HTTPS ...
2
votes
1answer
804 views

AES GCM encryption, authentication and PBKDF2

I'm developing a kind of secret vault server application. The basic principle is similar to DPAPI where each secret will have its own unique random KEY/IV pair and and that KEY/IV pair will be ...
0
votes
0answers
122 views

Is there a reduction of security if I XOR Pkcs5S2 and SecureRandom?

I'm using this codereview sample to encrypt data. I would like to provide hardware protected encryption and a user password as the key. Is it acceptable to XOR the KDF Pkcs5S2 in Bouncy Castle with a ...
3
votes
1answer
65 views

How much does using the same $H$ for all messages weaken GCM?

How much is GCM weakened by using the same MAC key $H = E_K(0^*)$ for all messages that use the same key (which is what GCM actually does) instead of using $E_K(N||0_{32})$ (which is different for ...
1
vote
2answers
1k views

Parallel file encryption and authentication for large files

For a cloud storage upload client I want to encrypt files during upload, so that they cannot be read by the cloud service provider or anyone who gains access to the account. I would like to use some ...
2
votes
2answers
1k views

GCM: use the same key:IV pair to encrypt file and filename

Using Java, I wrote a piece of code that encrypts a given file with AES in GCM mode of operation. So far nothing uncommon. Now I would also like to encrypt the filename, in the following way: ...
2
votes
0answers
285 views

Is OCB the state of the art in authenticated encryption modes of operation for block ciphers?

OCB mode seems to represent the state of the art in authenticated encryption modes, largely due to its speed – it is faster than GCM even when GCM has hardware support. Its only drawbacks seem ...
23
votes
2answers
2k views

Is GCM still recommended?

I stumbled across a forum thread where security researcher Thomas Ptacek seemed to have negative feelings towards GCM. I had always thought from prior readings that GCM was the current gold standard ...
0
votes
1answer
524 views

Sodium crypto_aead_aes256gcm_encrypt ciphertext length > plaintext length

Using the crypto_aead_aes256gcm functions from Sodium produces a ciphertext of "at most mlen (plaintext length) + crypto_aead_aes256gcm_ABYTES bytes (16 bytes) are put into c (ciphertext), and the ...
3
votes
1answer
868 views

Is it acceptable to write the nonce to the encrypted file during AES-256 GCM? [duplicate]

I've used AES-128 in CTR mode in the past and using the same key but different IVs for each file, I wrote the IV to the first 16 bytes. Is it safe to do so with the nonces used in AES-256 GCM? I'm ...
3
votes
0answers
36 views

Can GCM auth be bitsliced?

Is it possible to use bitslicing for GCM? This seems like a way to allow for a way to avoid cache-timing attacks without PCLMUL instructions and with good performance.
2
votes
0answers
208 views

Effect of the birthday bound on AES-GCM [duplicate]

What is the effect of the birthday bound on the security of AES-GCM, when a very large number of messages are encrypted? I am looking for attacks that are useful in obtaining information about the ...
1
vote
2answers
132 views

Is this a better GCM?

Using the keystream from the block cipher for both parts of the GMAC key (initialization and encrypting the auth tag) seems to produce a better mode of operation than GCM, as successful forgeries and ...
6
votes
1answer
259 views

Do Carter–Wegman MACs allow key reuse if the MAC tag is kept secret?

Poly1305 (and GHASH) are secure authenticators, but only for one use. Thus, nonce reuse in Poly1305-AES, ChaCha20-Poly1305, and AES-GCM all reveal the authentication key. However, my understanding ...
6
votes
2answers
861 views

Security of encrypting many short values with AES in GCM mode

We intend to encrypt certain values in a database which holds personal information such as addresses so as to prevent data leakage should the database be compromised. The intention is that each field ...
3
votes
1answer
639 views

Is the length limit of AES-GCM per key or per (key, nonce) pair?

AES-GCM has a limit on the length of the plaintext it encrypts: $2^{39} - 256$ bits. But is this limit per key or per (key, nonce)? That is, if I encrypt a message with the maximum length, and encrypt ...
19
votes
3answers
4k views

Plain text size limits for AES-GCM mode just 64GB?

Based on NIST SP 800-38D section 5.2.1.1, it seems that the maximum length of plaintext is 2^39-256 bits ~ 64 GB. We've got 100+GB files in genomics that need to be GCM encrypted so are concerned ...
3
votes
1answer
454 views

Randomness and increment of nonce in GCM

2 questions about nonce usage in GCM: Is it safe to use non-random nonce in GCM? Say I use 0x1 for m1, 0x2 for m2, so on. How much should a nonce increased for a file? Say I use 0x1000 as a nonce to ...
1
vote
0answers
207 views

AES-GCM Hash sub key parameter in Intel's IPsec library

I am trying to use Intel's optimized AES-128-GCM implementation (from the Intel white paper “Fast Multi-buffer IPsec Implementations on Intel Architecture Processors”, you can find the code here). ...
-2
votes
1answer
221 views

programming a sniffer for AES GCM with gcrypt

I want to write a sniffer that can read AES-GCM communication using the gcrypt lib I can see in the manual that for encryption there is an additional 2 methods (for AEAD) but what about decryption ? ...
1
vote
0answers
5k views

bank websites using AES_256_CBC vs AES_128_GCM/CBC [duplicate]

Hello i have just recently started learning about cryptography, so i was doing some little research on what kind of encryption techniques and modes that were used in bank web pages. I have noticed ...
6
votes
1answer
4k views

How can there be AES-256-GCM, when GCM is defined for 128-sized blocks?

In both node.js and OpenSSL, I am seeing cipher "aes-256-gcm". However, in NIST Special Publication 800-38D, that defines GCM, I am reading: The underlying block cipher shall be approved, the ...
3
votes
0answers
465 views

Reference AES-NI assembler code for AES-128-GCM? [closed]

I want to implement AES-128-GCM in assembler using Intel AES-NI instructions. I have found reference code in the Intel AES-NI Whitepaper but I don't see code for the GCM mode there (or indeed any use ...
1
vote
1answer
954 views

Using AWS KMS with AES GCM

I am implementing client-side encryption for data stored in AWS DynamoDB, and was wondering about the correct use of AWS KMS for key management in addition to using AES/GCM. I am using the master key ...