# Tag Info

6

Latency, probably. $\mathrm{GHASH}_K(m) \oplus \mathrm{AES}_K(n)$ lets you compute both in parallel, whereas encrypting the $\mathrm{GHASH}$ output would add significant latency for short messages. The authors go to great detail about this in Section 3 of the original GCM document. A similar competing mode at the time, CWC, did indeed encrypt the MAC ...

5

If a (nonce, key) is reused with two distinct messages A and B, an attacker can learn A⊕B = E(A)⊕E(B). So, if either plaintext is known, the other one can be immediately decrypted. This is why nonce-misuse resistant schemes require two passes: a first pass to compute a hash of the message, the second one to perform the actual encryption with an IV, and ...

5

LibreSSL supports AEAD ciphers, including aes-256-gcm: $openssl enc -aes-256-gcm -nosalt -p -in file.in -out file.out enter aes-256-gcm encryption password: Verifying - enter aes-256-gcm encryption password: key=A744E1091C25BABD36B50E40FB8D311A672722729CEA6E217AD9FA8AF23CAF57 iv =BDEEA37B93BB989C6C40665B If you don't mind writing your own software, there ... 4 You'll have to guess the plaintext of at least one block (128 bits) that is on a 128 bit boundary from the start of the GCM ciphertext. Then you can XOR it to retrieve 128 bits of the key stream. Now the key stream you can decrypt since you have the key. This will get you a counter value. The counter in GCM mode starts with a 12 byte nonce and the counter ... 4 Is it safe to store all of that information at the same place? All the information (salt, pbkdf2, iterations, iv, GCM tag, encrypted payload) is listed can be considered as public information. We already consider that an attacker has the knowledge of all of these but the encryption key by the Kerckhoffs's principle. A log file will typically ... 4 Can I make a fixed-length encryption output? Sure you can - on encryption, you can first pad out the plaintext to a fixed length (and then perform the GCM encryption). On decryption, you perform the GCM decryption, and then depad. Obviously, the padding will need to contain a 'amount of padding I added' field (so that the depadding operation can remove ... 4 Can xor`ed tags info be useful for any kind of attack? Yup; by using the same IV for multiple generated tags, the attacker can effectively recover the internal GCM value$H$, and with that, generate tags for any arbitrary data. (You stated that xor'ing the two tags discarded$H$; unless you are using the notation$H$to mean something other than the secret ... 4 What you are doing sounds like piling on complexity of dubious value without a clear understanding of what security the components actually provide, in the hope that enough complexity will render the question moot. I would advise you discard the hare-brained scheme you've cooked up and start from something much simpler that is easier to prove theorems about.... 4 I'd split the key into two 256 bit keys using HKDF, and use one key for the GCM mode, and the other for the hash over the plaintext. However, I then would use HMAC rather than SHA-256 as it accepts and the key as a separate entity in the application. The advantages of the HKDF key derivation function is that there is more "distance" between the keys used ... 3 This is one of the most poorly written "mainstream" crypto papers I've read. Sorry, McGrew and Viega. Field representation and bit order GCM works in the binary field$GF(2^{128})$. Elements of this field can be represented as polynomials with binary coefficients (i.e. 0 or 1). Using the notation of the paper, here are some examples of field elements:$1$... 3 However, if data is encoded with a nonce that's clearly visible (one common implementation prepends the ciphertext with a nonce), then it is possible to replace the entire ciphertext with a previously valid ciphertext (since the nonce is known). This is known as a 'replay attack', and is typically handled at a higher level. One easy way is the TLS approach;... 3 With IKEv2 all payloads are generally sent in a single Encrypted Payload (SK) whose data is both encrypted and integrity protected/authentication (that protection covers the complete message, including the header and optional unencrypted payloads). That works quite nicely with modern AEAD algorithms like AES-GCM, the additional authenticated data (AAD) are ... 3 The AES-GCM forgery probability bounded by$qL/2^\tau$where$q$is the number of messages,$L$is the maximum message length in 128-bit blocks, and$\tau$is the length of the tag. Here you've truncated it to 64 bits, rather than 128 bits, so if you allow messages up to 16 megabytes long, the forgery probability after a single attempt is already around$1/...

3

AES-GCM does not support ‘no AAD’ as distinct from ‘zero-length AAD’. See NIST SP800-38D for details of how it works internally: the AAD is padded with zeros so it is a multiple of 128 bits long, and the length is hashed in at the end. If the AAD is zero-length, then zero bits of padding are added and no time is spent hashing any AAD or AAD padding. ...

2

Your $k_2$ value is functioning effectively the same way as conventional password verification methods, where you store a salted password hash of the users' passwords. So it allows for an adversary to test password guesses, but— So does the authenticated GCM $(c, tag)$ pair; The memory hard scrypt function is your main line of defense against this attack ...

2

You can use a similar method like VeraCrypt. Also, you can use a better Key derivation alternative like Argon2id. Argon2id is the combined version of Argon2d, data-dependent, and Argon2i data-independent modes. For the encryption Get/force a good password from user and use it with Argonid with application/usage dependent domain separation $$k = \... 2 If you will look at Probabilistic encryption in Wikipedia, that will explain shortly. GCM mode internally uses CTR mode and therefore let's concentrate on CTR mode. CTR mode converts a block cipher into a stream cipher. In CTR mode, one encrypts the (nonce\mathbin|counter) then x-or the plaintext then increments the counter like$$C_i = P_i \oplus E(k, ...

2

If you cannot eliminate the weak points, you can indeed work around them. I will not specifically try to sound like a paranoid here and say outright that this is by design, but FIPS/NIST standards can sometimes be designed in such a way that they are difficult to implement securely, and the cost of doing it wrong can be catastrophic. Working around it by ...

2

Would there be any benefit to symmetrically encrypting the IV and MAC in an AEAD mode of operation? Not really. The MAC is already encrypted as part of GCM mode. Encrypting the IV just hides it, decryption of the message still requires the key. More specifically would this prevent someone from exploiting the accidental use of a duplicate IV with the same ...

2

I thought I'd update this with what I learned designing my ASIC. I found the literature and terminology very ambiguous, even McGrew & Viega's paper on GCM. Thanks to Poncho and others for their answers. Here are some notes from my code: ************************* Nonce Format ***************************** |<-- Counter Block (CB) (128 ...

2

I found following explanation in a book (Serious Cryptography) OCB is a bit less fragile than GCM against repeated nonces. For example, if a nonce is used twice, an attacker that sees the two ciphertexts will notice that, say, the third plaintext block of the first message is identical to the third plaintext block of the second message. With GCM, attackers ...

2

Does Camellia-GCM use Camellia-CTR to create GCM Hash? GCM is a mode of operation for a 128-bit blocksize block cipher that turns it into an authenticated encryption scheme. It doesn't care about whether you're using AES, Camellia, Twofish, Serpent or MARS. It will work the same way for all of these block ciphers. So yes, Camellia-GCM uses Camellia-CTR ...

2

If the counter mode started at $\text{Nonce}\mathbin\|0^{32}$ instead of at $\text{Nonce}\mathbin\|0^{31}\mathbin\|1$ then one could submit an encryption query for $(0^{96},0^{128})$, i.e. the 128-bit all-zero plaintext along with the all-zero nonce. The first block of the ciphertext would then be computed as $E_K(0^{128})\oplus 0^{128}=E_K(0^{128})$ which ...

2

If you insist on random nonces, 128 bit random nonces are safer than 96 bit random nonces (but not as good as 96 bit counter-based nonces - I presume that is infeasible in your scenario). The 128 bit random nonce is transformed (via GHash) into what is effectively a 96 bit nonce and a 32 bit counter; in the 96 bit case, the 96 bit nonce is used directly, ...

2

Most discussions of Shor's algorithm are for integers but how applicable is it for polynomials? Quite applicable; Shor's algorithm treats the group operation as a blackbox, hence it treats an even characteristic curve just like it does a prime curve. The only practical difference is the cost differential (in terms of qubits, circuit complexity and depth) ...

1

You appear to have computed things correctly. However, you have quoted their Corollary 1 wrong: you've included an extra $-q^22^{-128}$ term in the confidentiality part (don't know if that was what confused you though). To get their $2^{-89.4}$ instead of your $2^{-89.5}$ simply include more decimals of $\log_2(95)$.

1

I do read some article saying, the hacker is able to alter the data which can still result the same CRC computed value in the end. Obviously, yes. The CRC32 function is completely public, with no secret inputs. Hence, the attacker can compute the CRC32 of any modified data he wants, insert the tag, and it would validate. In contrast, GCM does have a ...

1

If there is no regulatory requirement, for AES-128, a good option would be splitting the SHA-256 hash into a key (128-bit), IV (96-bit), and any unused portion. That allows us to make the IV implicit (and secret, which is unnecessary, but does not harm) thus saves even so little bandwidth. For AES-192 or AES-256, we can do this with SHA-512 instead of using ...

1

You could also check if you're version of OpenSSL supports CCM mode. That's an authenticated mode just like GCM. I tried a version of OpenSSL I happened to have on my machine and it supports CCM, but not GCM.

1

Perhaps a workaround for this would be to instead use deterministic nonce generation with AES-GCM-SIV, which has been formally proposed in a paper by Shay Gueron and Yehuda Lindell. The core idea is to use the MAC over the plaintext as part of the initial counter for encryption and reuse that as a tag on decryption. This can be bolted onto any AES and GCM ...

Only top voted, non community-wiki answers of a minimum length are eligible