Search Results
| Search type | Search syntax |
|---|---|
| Tags | [tag] |
| Exact | "words here" |
| Author |
user:1234 user:me (yours) |
| Score |
score:3 (3+) score:0 (none) |
| Answers |
answers:3 (3+) answers:0 (none) isaccepted:yes hasaccepted:no inquestion:1234 |
| Views | views:250 |
| Code | code:"if (foo != bar)" |
| Sections |
title:apples body:"apples oranges" |
| URL | url:"*.example.com" |
| Saves | in:saves |
| Status |
closed:yes duplicate:no migrated:no wiki:no |
| Types |
is:question is:answer |
| Exclude |
-[tag] -apples |
| For more details on advanced search visit our help page | |
Results tagged with aes-gcm
Search options answers only
not deleted
user 452
Deprecated tag, see tag info. Advanced Encryption Standard Galois/Counter Mode, better known as AES-GCM is a mode of operation for symmetric key cryptographic block ciphers that has been widely adopted because of its efficiency and performance. GCM supports authenticated encryption, meaning that the mode not only offers privacy, but also integrity.
2
votes
Can I prove AES-GCM nonce reuse just from the bytes?
When I generate input which should only affect timestamps and counters in very specific bytes, I see corresponding ciphertext changes only in those bytes for 2 subsequent calls to the encryption func …
- 151k
2
votes
Accepted
Do I need to use unique IVs if all encrypted data is unique?
Is this necessary for my use case? I've read that this is done so encrypting the same data twice does not result in the same ciphertext, but in my case this is exactly the necessary behavior.
Making …
- 151k
1
vote
Nonce reuse in GMAC without ciphertext (only AAD)
However, I'm wondering if the same risks are present if an adversary has access to:
Ciphertext and corresponding MAC of one message
Small amount of plaintexts and MACs of different messages
If the …
- 151k
3
votes
AES-GCM vulnerabilities
Does AES-GCM take replay attacks into consideration?
The GCM decryptor is stateless and so it cannot prevent replay attacks by itself. What GCM does is give the tools for the protocol using GCM t …
- 151k
1
vote
Accepted
Performance of AES NI using crypto++
Issue is that the performance is very slow, it is around 2 microseconds, more strangely when I call the function again using same encryptor then it takes only 150 nanoseconds.
Two obvious possibilit …
- 151k
6
votes
Encrypting arbitrary large files in AEAD chunks - how to protect against chunk reordering?
This is the sort of thing that Additional Authenticated Data (AAD) was made for.
One potential attack that an AEAD cipher needs to address is the adversary taking a valid encrypted message (that was s …
- 151k
3
votes
Accepted
Does HMAC provide anything that AES GCM does not?
Should I use aes gcm + hmamc or just aes gcm?
Just aes gcm is fine - GCM includes the integrity protection.
I heard aes gcm provides messages authentication suing Ghash. But ghash is not a mac, so …
- 151k
3
votes
Accepted
Why is IV in RFC8448 examples only 12 octets instead of 16?
the IV in examples is only 12 bytes long instead of 16, which is required for AES-128-GCM.
That is incorrect; while GCM supports any nonce length, it is both simpler and more secure with 12 byte non …
- 151k
4
votes
Accepted
What kind of hashing is GF multiplication in GCM cipher mode and GMAC?
In GCM, GMAC, the additional associated data (AAD) (as well as outputs of subsequent blocks) is multiplied by a polynomial H in GF(2^128).
Actually, it's the other way around; the AAD and the cipher …
- 151k
6
votes
Is it possible to reverse GHASH from GCM?
If this is possible, what is the process for achieving this?
It's actually quite easy, if you know how to do operations in $GF(2^{128})$, specifically, addition, multiplication and computing inverse …
- 151k
2
votes
Accepted
Implementing AES GCM but not getting correct output from cipher block
aes_key_expansion = CreateKeyExpansion(Y1)
E(K,Y1) = AES_128_Cipher(K, aes_key_expansion)
I believe this is problem; you appear to be encrypting k using Y1 as an AES key. Instead, w …
- 151k
2
votes
Accepted
AES GCM Difference between the IV and the Secret Key?
And the Secret Key is passed (with the Key Expansion) to E_k for encryption?
Yes, the key is given to the block cipher - it is indeed the $k$ in $E_k$
- 151k
1
vote
AES256-GCM padding for unaligned blocks
With SHA256 you pad with 0x80 and then 0x00s, does AES256-GCM require the same?
For GCM, the AAD is zero-padded to a multiple of 16 bytes (with no padding if it's already a multiple of 16 bytes in l …
- 151k
1
vote
What is the use of Additional data or associated data in AESGcm. How it is used while encryp...
Can anybody explain these different fields in both the algorithms and their usage.
Both these fields are designed to detect it if someone in the middle tries to play games with the encrypted data. …
- 151k
3
votes
Accepted
Key Committing AES-GCM
do I understand correctly that $\mathcal{A}$ needs to be able to 'modify' the ciphertext $C$ to be able to perform the outlined attacks?
No, these attacks assume that the attacker generates $C$; he …
- 151k