Search Results
| Search type | Search syntax |
|---|---|
| Tags | [tag] |
| Exact | "words here" |
| Author |
user:1234 user:me (yours) |
| Score |
score:3 (3+) score:0 (none) |
| Answers |
answers:3 (3+) answers:0 (none) isaccepted:yes hasaccepted:no inquestion:1234 |
| Views | views:250 |
| Code | code:"if (foo != bar)" |
| Sections |
title:apples body:"apples oranges" |
| URL | url:"*.example.com" |
| Saves | in:saves |
| Status |
closed:yes duplicate:no migrated:no wiki:no |
| Types |
is:question is:answer |
| Exclude |
-[tag] -apples |
| For more details on advanced search visit our help page | |
Results tagged with aes-gcm
Search options answers only
not deleted
user 452
Deprecated tag, see tag info. Advanced Encryption Standard Galois/Counter Mode, better known as AES-GCM is a mode of operation for symmetric key cryptographic block ciphers that has been widely adopted because of its efficiency and performance. GCM supports authenticated encryption, meaning that the mode not only offers privacy, but also integrity.
17
votes
Accepted
Can AES-GCM be broken if initialisation vector is known?
However, we are using the same nonce/IV to encrypt different data.
No, don't do that
if someone indeed gets hold of the plain-text nonce/IV and a number of different encrypted messages (which …
- 151k
10
votes
Why was AES CBC removed in TLS 1.3?
from what I know CBC is the most secure Mode of operation for the AES block cipher
I'm not exactly sure why you say this; however, there has been a couple of practical problems with CBC mode in t …
- 151k
8
votes
Accepted
What is Associated Data in AEAD?
First of all, let us look at what AAD is; it is a string that must be presented both at encryption and decryption; if the decryptor presents the wrong string, the decryption fails.
Why is this useful? …
- 151k
6
votes
Accepted
Why is GCM not vulnerable at the birthday bound for 128 bit IV?
Actually, it turns out that GHASH on 128 bit values is a permutation (unless $H=0$; this happens with probability $2^{-128})$
GHASH of a 128 bit value $X$ simplifies to $\text{GHASH}_H(X) = H \times …
- 151k
6
votes
Is it possible to reverse GHASH from GCM?
If this is possible, what is the process for achieving this?
It's actually quite easy, if you know how to do operations in $GF(2^{128})$, specifically, addition, multiplication and computing inverse …
- 151k
6
votes
Encrypting arbitrary large files in AEAD chunks - how to protect against chunk reordering?
This is the sort of thing that Additional Authenticated Data (AAD) was made for.
One potential attack that an AEAD cipher needs to address is the adversary taking a valid encrypted message (that was s …
- 151k
5
votes
Why this complexity defining AES-GCM counter block?
AES-GCM counter block is defined as nonce || IV || counter
That is not true. AES-GCM effectively has two different versions. If you have a 96 bit nonce, then the counter block is (by your termi …
- 151k
5
votes
Accepted
Does re-transmission really reduce security?
Your colleague is wrong; assuming that the GCM nonces are generated correctly (that is, never repeats for the same key), there is no risk to GCM in repeating the VCC.
GCM has the property that, as lo …
- 151k
5
votes
Can a zero nonce be safely used with AES-GCM if the key is random and never used again?
Am I missing anything?
No, you are not; if you use a key only once, that is, to encrypt a single message, and never use it to encrypt anything else, then it doesn't matter what nonce you use. An …
- 151k
5
votes
AES-GCM: Verification before Decryption
Therefore, the cipher must be decrypted in order to verify its integrity?
No, there is no such requirement. As you state, the authentication tag is calculated from the ciphertext blocks, however, t …
- 151k
4
votes
Stream cipher and block cipher usage in network data encryption
In L3 ad L4 security protocols (IPSec and SSL) block ciphers are preferred (AES-CBC).
Errr, no. Originally, SSL used RC4 (which is a stream cipher); then CBC mode (first DES/3DES and then AES) was …
- 151k
4
votes
Accepted
AES-GCM Encryption and Replay Attacks
Is it correct that Alice sends the ciphertext $CT=E_K(IV,AAD,D)$ to Bob together a timestamp $t$ like $CT||t$
That doesn't work; here, GCM doesn't protect $t$; the attacker can easily change it t …
- 151k
4
votes
Accepted
How to apply IV and tag to protect messages encrypted using AES-GCM?
1.The IV should be unique for each 128 bit text or for each massage?
Per message. Using an IV of 0 for the first message, 1 for the second, etc is just fine (no matter how long each message is), …
- 151k
4
votes
Accepted
What kind of hashing is GF multiplication in GCM cipher mode and GMAC?
In GCM, GMAC, the additional associated data (AAD) (as well as outputs of subsequent blocks) is multiplied by a polynomial H in GF(2^128).
Actually, it's the other way around; the AAD and the cipher …
- 151k
4
votes
Accepted
Why is the subhash key (H) of AES-GCM defined as such?
In GCM, GHASH doesn't use K directly in order to ensure that if GHASH's key is compromised, the master key K remains secret.
Actually, there's not why GCM was designed the way it was (it may be …
- 151k