34 votes
Accepted

AES-GCM recommended IV size: Why 12 bytes?

From the proposal of GCM (rewritten if statement): if $\operatorname{len}(IV) = 96$ then $Y_0 = IV || 0^{31}1$ else $Y_0 = \operatorname{GHASH}(H, \{\}, IV)$. So there are additional ...
Maarten Bodewes's user avatar
  • 92.6k
30 votes
Accepted

Does AAD make GCM encryption more secure?

In general the AAD itself is not required or won't change the security of the GCM mode of operation itself. It may however directly influence the security of the protocol in which GCM is deployed. ...
Maarten Bodewes's user avatar
  • 92.6k
22 votes
Accepted

How bad it is using the same IV twice with AES/GCM?

Even a single AES-GCM nonce reuse can be catastrophic. A single nonce reuse leaks the xor of plaintexts, so if one plaintext is known the adversary can completely decrypt the other. This is the same ...
Squeamish Ossifrage's user avatar
20 votes
Accepted

how does BearSSL's GCM modular reduction work?

There are three important points here to consider. 1. We work in $\mathbb{F}_2[X]$. This means that we do additions and multiplications of binary polynomials, i.e. polynomials whose coefficients are ...
Thomas Pornin's user avatar
17 votes

Does AAD make GCM encryption more secure?

AAD has nothing to do with making it "more secure". The aim of AAD is to attach information to the ciphertext that is not encrypted, but is bound to the ciphertext in the sense that it cannot be ...
Yehuda Lindell's user avatar
17 votes
Accepted

Is GCM still recommended?

The "hard part" about GCM implementation is resistance to side-channel attacks, especially cached-based. GCM is the combination of AES-CTR, and a custom MAC that relies on multiplications in a binary ...
Thomas Pornin's user avatar
16 votes
Accepted

How was the GCM polynomial found?

For the GCM mode polynomial, it's likely that they simply looked it up in a table. Low-weight irreducible polynomials over ${\rm GF}(2)$ are useful enough that people have spent time compiling lists ...
Ilmari Karonen's user avatar
16 votes
Accepted

AES GCM : is it acceptable to return the wrong plaintext if the tag is incorrect?

There is an article* that answers the question in the negative for GCM and CCM. The article introduces the first formalization of the Releasing Unverified Plaintext (RUP) setting. The related security ...
kelalaka's user avatar
  • 48.5k
15 votes
Accepted

GCM padding or not?

TL;DR: Padding is part of the specification of the mode and thus doesn't need to be done by the user of the primitive. Internally GCM really is CTR mode along with a polynomial hashing function ...
SEJPM's user avatar
  • 46k
13 votes

AES-GCM recommended IV size: Why 12 bytes?

In the general case, the security goal is to reduce the probability that the internal 128-bit counter block ever takes the same value when instantiating the GCM cipher with a given key. That is ...
SquareRootOfTwentyThree's user avatar
13 votes
Accepted

Relationship between AES GCM and AES CTR

That's correct. In most cases you can do what you are proposing. However be warned that by disregarding the authentication you clearly loose message authentication and bit flipping in AES-CTR ...
Ruggero's user avatar
  • 7,084
13 votes
Accepted

GCM as a general purpose cryptographic hash?

GCM does not provide secure hashing. In general, a MAC has all the properties of a hash only against an adversary who does not know the key. If you want to use the function as a MAC then the key has ...
Gilles 'SO- stop being evil''s user avatar
13 votes
Accepted

Would an encryption-only block cipher be useful at all?

Would it make any sense to design an irreversible block cipher where the encryption side wouldn't be reversible (and thus you can't implement decryption), Block cipher is a synonym for Pseudo Random ...
kelalaka's user avatar
  • 48.5k
12 votes

AES GCM : is it acceptable to return the wrong plaintext if the tag is incorrect?

how can we prevent the cipher from being returned in case the tag is wrong ? As far as I understand, to compute the tag the decryption process must be done entirely. Actually, GCM decryption can be ...
poncho's user avatar
  • 147k
11 votes
Accepted

Use Initialization Vector as Additional Authenticated Data

You don't need to put the IV in the AAD (Additional Authenticated Data) as already indicated in the comments. The GCM proposal as adopted by NIST (PDF) clearly specifies this in paragraph 2.1 Inputs ...
Maarten Bodewes's user avatar
  • 92.6k
11 votes
Accepted

TLS 1.2 Cipher Suites With AES-GCM – What data (if any) is passed to the AES-GCM cipher as the Additional Authentication Data?

Actually section 6.2.3.3 of RFC 5246 talks about the associated data: The additional authenticated data, which we denote as additional_data, is defined as follows: ...
SEJPM's user avatar
  • 46k
11 votes
Accepted

Is 'authenticated' in AEAD actually authentication? Or is it message integrity?

The notion of authentication stated in the question seems to be more compatible with what is sometimes talked to as entity authentication. In short, "you know who you are talking to." ...
Marc Ilunga's user avatar
  • 3,188
10 votes
Accepted

What is the purpose of the "Explicit Nonce" in TLS for AES-GCM and AES-CCM?

This additional 32 bit nonce acts as a salt, and makes multicollision attacks $2^{32}$ times harder. In this attack, the attacker collects a huge number of TLS sessions, each with a record encrypted ...
poncho's user avatar
  • 147k
10 votes

GCM: use the same key:IV pair to encrypt file and filename

This is terrible. In GCM, if you use the same nonce, then the authenticator is completely broken (for all messages in the future). You should never assume that the attacker doesn't know the filename ...
Yehuda Lindell's user avatar
10 votes
Accepted

How does the GCM encryption limit affect TLS connections?

Actually, that limit does not affect TLS. TLS encrypts each record separately, using a fresh IV for each. A record is limited to 16kbytes in length, and hence you'll never hit the 64Gbyte limit in ...
poncho's user avatar
  • 147k
10 votes

Poly1305-AES vs AES-GCM

Poly1305-AES is a message authentication code. AES-GCM is an authenticated cipher. So it isn't a meaningful comparison. But we could compare Poly1305-AES with AES-GMAC, which is a message ...
Squeamish Ossifrage's user avatar
10 votes

Why does AES-GCM not require an auth key, but encrypt-then-mac does?

AES-GCM does require an authentication key. You don't need to pass it because it is generated from the encryption key by encrypting an all-zero "plaintext" block: The hash subkey, denoted $H$, is ...
knbk's user avatar
  • 865
10 votes
Accepted

Why doesn't the GCM spec use a more efficient multiplication algorithm?

My question is... why? There are a number of different algorithms that perform $GF(2^{128})$ multiplication, all with different trade-offs (speed on specific platforms, program size, memory usage, ...
poncho's user avatar
  • 147k
9 votes
Accepted

Useful additional data to employ in GCM

There are few requirements for the additional data in the GCM document of NIST. There are some limitations on the size of the AAD, the maximum is $len(A) ≤ 2^{64}-1$ in bits. Furthermore the ...
Maarten Bodewes's user avatar
  • 92.6k
9 votes
Accepted

Are lookup tables safe when they fit in a cache line?

The typical cache line size of modern x86 machines is 64 bytes. This might not be true for all processors. You should retrieve that from system if you want to know that. Ideally you should split data ...
axapaxa's user avatar
  • 2,940
9 votes
Accepted

What is a safe maximum message size limit when encrypting files to disk with AES-GCM before the need to re-generate the key or NONCE

Security analysis of AES-GCM for maximum key use Note: I am not a cryptographer. As such there are probably mistakes in my analysis. Please help me fix my mistakes and built on top of this answer so ...
Stan Ivanov's user avatar
9 votes
Accepted

IV in Galois Counter Mode

The diagram shows the gist of the algorithm, but not everything in it. The bulk of the encryption in GCM uses AES in CTR mode. "CTR mode" means that "successive" values of a counter are encrypted ...
Thomas Pornin's user avatar
9 votes

Can a zero nonce be safely used with AES-GCM if the key is random and never used again?

Usually. However, if you are using 128-bit AES in CTR mode (remember that GCM is essentially just CTR with authentication), then a kind of attack called a multi-target attack can become possible. This ...
forest's user avatar
  • 15.3k
8 votes

Should I use XTS or GCM to encrypt my hard drives?

XTS is designed so that the plaintext and ciphertext sizes are the same. This is "needed" for disk encryption in order to preserve the sector size. However, when you are encrypting your disk at the ...
Yehuda Lindell's user avatar
8 votes
Accepted

How to implement "online" feature of GCM?

As you suspect, it's possible to rearrange the GHASH computation so that can compute both the AAD and the encrypted data online and independently. As you recall, GHASH is defined as: $$\mathrm{GHASH}...
poncho's user avatar
  • 147k

Only top scored, non community-wiki answers of a minimum length are eligible