New answers tagged gcm
0
If you encrypt 264 blocks or more than an attacker can forge encrypted data, i.e. you lose authentication.
Also, be careful about how much total data you encrypt with a key (no matter how many unique IVs are used). Schneier, et.al. once recommended that with CBC mode you encrypt at most 232 blocks, but with CTR mode you could go to 260 or so blocks due to ...
4
Well, supposing everything is properly domain separated, nonces are always generated randomly for encryption queries, and your KDF behaves like a perfectly random function, the first step is to bound the probability of a nonce repeat. A birthday bound tells us that this happens with probability at most
$$
q^2/2^{256}\,,
$$
where $q$ is the number of ...
1
Could this scheme be used as a nonce-misuse resistant alternative for AES128-GCM?
Well, no, it's not nonce-misuse resistant. Consider the case where you use the same nonce twice (which is pretty much the definition of 'nonce-misuse'); there, you'll end up encrypting two different messages with the same GCM key and IV, which would leak the xor of the two ...
Top 50 recent answers are included
