New answers tagged gcm
3
As I understand, GCM will also be broken by quantum computing
The idea that GCM would be broken is, at best, questionable; it is broken only in the scenario where you allow the attacker to make entangled queries, and is returned entangled answers. That is, for this to be an applicable attack, the implementation under attack must also be a Quantum ...
2
Just an additional point of information from the field. The NIST spec is strict in not allowing this, and it has good properties if an API does not do this. For example it protects against naive usage of the API which streams partial responses to some processing code which might execute commands or reveal timing information in side channels. However the ...
4
There are several reasons for an authenticated decryption (with AES-GCM or any other AE or AEAD mechanism) not to return any plaintext if the ciphertext is not authentic (i.e if the tag does not match).
One danger is if the calling code starts using the partially decrypted plaintext. Suppose the caller does something with the beginning of the plaintext, then ...
answered Apr 13 at 21:29
Gilles 'SO- stop being evil'
14.4k3 gold badges39 silver badges74 bronze badges
5
Is it acceptable to return the wrong plaintext if the tag is incorrect?
No. For one, it's against the spec quoted in question.
How bad is it to return the wrong plaintext anyway?
It's bad at least because if the AES-GCM API returned the wrong plaintext, then the software on top of the API might unwillingly use that wrong plaintext, just ignoring that it's ...
14
There is an article* that answers the question in the negative for GCM and CCM. The article introduces the first formalization of the Releasing Unverified Plaintext (RUP) setting. The related security notion is the Ind-RUP.
The security question is can an adversary forge messages with unverified messages? In this game, confidentiality is not relevant, since ...
10
how can we prevent the cipher from being returned in case the tag is wrong ? As far as I understand, to compute the tag the decryption process must be done entirely.
Actually, GCM decryption can be done in a two-step procedure:
Step 1: compute the expected GCM tag (which is a function of the ciphertext, AAD, teh secret H value, combined with the nonce and ...
Top 50 recent answers are included
