New answers tagged gcm
0
Indeed $H=E_k(0)$ is used to choose from the family. This is not a problem, and here is some intuition on why.
The output of the hash function is not leaked in clear, it is "hidden" by xoring with $E_k(iv,ctr=0)$ which is different per each encrypted message (in contrast to $H=E_k(0)$). Otherwise it would be indeed trivial to recover H as the UHF ...
0
I've used Algorithm 3 of the paper for this purpose.
$M[128] ← e1||0^{120} $ instead of H
$P ← 04||0^{120} $ which is 2 with reverse bits
0
The polynomial f would be 0xe1, no?
it is $e1 \mathbin \|0^{120}$ i.e. 0xe1000000000000000000000000000000
What would be the value of the element P, if it corresponds to the polynomial α?
it is 2 reversed i.e. 0x40000000000000000000000000000000
Top 50 recent answers are included
Related Tags
gcm × 259aes × 139
authenticated-encryption × 48
encryption × 38
aes-gcm × 33
initialization-vector × 25
nonce × 19
modes-of-operation × 17
mac × 16
tls × 15
cbc × 15
block-cipher × 13
authentication × 13
hmac × 13
ccm × 12
openssl × 10
file-encryption × 9
hash × 8
implementation × 8
key-derivation × 6
sha-256 × 6
stream-cipher × 6
finite-field × 6
rsa × 5
symmetric × 5