Questions tagged [gcm]
The Galois Counter Mode, an authenticated encryption mode of operation for a block cipher.
318 questions
3 votes
0 answers
111 views
Circumventing birthday bounds in AES-GCM?
I'm looking at using AES-256-GCM to encrypt data at rest (in a database) with logged-in user id's (among possibly other things) as the authenticated data. I'd like the application to (eventually) ...
- 373
0 votes
1 answer
131 views
Using AES GCM with IV [prefix + counter], can I just change the prefix instead of changing the whole AES key if the counter overflows?
I'm making an online Client-Server game where upon a client's connection a sessionKey is generated by the server and exchanged securely under TLS during authentication, so that the client can also ...
6 votes
1 answer
968 views
Why does the GCM counter start at 1?
According to the NIST spec of GCM (p. 15), the pre-counter block is $J_0 = IV || 0^{31} || 1$ when a 96-bit IV is used. My question is: Why is $J_0$ not $IV || 0^{32}$? This would increase plaintext ...
0 votes
1 answer
104 views
GCM AES over (wireless) internet - why reset counter with every packet?
I'm learning about block cipher operation modes and have a small question. I am listening to a lecture recording that casually mentions that when using Galois Counter Mode with AES over the internet (...
- 103
0 votes
1 answer
95 views
Cracking HKDF, AES-GCM with tiny files, other possible mistakes?
I lost a encryption key and therefore probably lost some files for good, but the program I used to encrypt files was something I wrote myself, so I'm wondering if there are mistakes I could use to ...
- 133
1 vote
1 answer
988 views
openssl enc -aes-128-gcm causes "enc: AEAD ciphers not supported" on CENTOS 8.5
I am trying to run an "openssl enc" command: openssl enc -aes-128-ccm -k "xxxx...xxx" -P -md sha256 and I am getting: ...
- 111
0 votes
1 answer
382 views
Tools to crack AES-GCM when IV is reused
I have read multiple times that data encrypted with the AES-GCM scheme fails catastrophically if you reuse the IV in different instances, leaking the XOR table (to my understanding this means no key ...
- 103
0 votes
0 answers
53 views
Is the output of a KOA multiplier the same as a standard * multiplier when implementing GF128? where can I find test vectors for KOA multipliers?
I am trying to implement a GF128 multiplier using the KOA (Karatsuba-Ofman Algorithm) approach. I have already implemented the KOA multiplier, but I am wondering if its output is the same as the ...
0 votes
0 answers
81 views
What block cipher should I use for encrypting GCM initialization vector counter-based nonce?
I'm implementing a mobile VPN product based on AES-GCM that should be resistant against fingerprinting the movements of mobile nodes. A difficulty is that the mobile nodes may not have the best ...
- 1,643
1 vote
0 answers
210 views
Best way of using AES GCM with static key PBKDF2/HKDF
Refering to this thread : using different IV and SALT with AES-CBC but same KEY I am in a similar situation to the one exposed, namely that I need to use AES to encrypt data, however, I cannot ...
- 31
1 vote
0 answers
103 views
GCM software optimization - R table calculation
I have written the python implementation below based on this AES-GCM spec document and the paper referenced within. The latter had some significant changes compared to its initial draft. I know my ...
- 11
1 vote
1 answer
274 views
Row level database encryption scheme
I am developing a row level database encryption scheme. Ideally I would not do this and instead rely on something vetted, but I haven't been able to find such a scheme online. My primary concerns are: ...
- 11
5 votes
1 answer
476 views
What best to put in unused nonce bytes when using AES-GCM-SIV
I want to use AES-GCM-SIV for authenticated encryption of messages in my protocol. Since it is a wireless protocol I want to transmit as few bytes as possible. For successful decryption I need to ...
- 151
3 votes
1 answer
338 views
High volume encryption with AES-GCM: AWS KMS vs CloudHSM
In my current project we will have to encrypt a lot of S3 objects (a few billions) with AWS KMS. Our security department requires that we use KMS keys backed by CloudHSM. But since CloudHSM incurs ...
- 31
1 vote
1 answer
174 views
Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit, why Not 2^39 [duplicate]
While examining the initial GCM specification by McGrew and Viega in 2005, it appears that the formation of the 128-bit Initialization Vector by combining a 96-bit nonce and a 32-bit unsigned wrapping ...
- 21