Galois/Counter Mode

In cryptography, Galois/Counter Mode (GCM) is a mode of operation for symmetric-key cryptographic block ciphers. The proposal was first published in 2007. The GCM algorithm belongs to the class of authenticated encryption with associated data (AEAD) methods. Given a key AD, GCM encrypts T.

GCM operates as a counter mode block cipher to produce ciphertext.

For authentication, the ciphertext blocks are treated as coefficients of a polynomial evaluated at a key-dependent point H using finite field arithmetic. The result is then encrypted, producing an authentication tag that can be used to verify the integrity of the data, so that the encrypted text has the IV, ciphertext, and authentication tag.

GCM operation. For simplicity, a case with only a single block of added authenticated data (labeled Auth Data 1) and two blocks of plaintext is shown.
Encryption: A series of 128-bit counters is encrypted using the block cipher E with key K; this can occur in parallel. The results are combined using bitwise XOR with 128-bit plaintext blocks, producing a series of ciphertext blocks.
Authentication: The Additional Data and these ciphertext blocks are combined using multiplication with a key-dependent constant H in the Galois field GF(2) to produce the authentication tag.

GCM combines the counter mode of encryption with the Galois mode of authentication. The central feature is the ease of parallel computation of the Galois field multiplication used for authentication. This feature has higher throughput than encryption algorithms like CBC that use chaining modes. The GF(2) field used is defined by the polynomial

H=Ek(0128) is the hash key, a string of 128 zero bits encrypted using the block cipher; m is the number of 128-bit blocks in C (rounded up); and the variable Si, defined as

len⁡(C) are the 64-bit representations of the bit lengths of v=len⁡(A) mod⁡ 128 is the bit length of the final block of C; and Xi=∑j=1iSj⋅Hi−j+1={0for i=0(Xi−1⊕Si)⋅Hfor i=1,…,m+n+1.

The second form is an efficient iterative algorithm (each Xi'={0for i≤0(Xi−k'⊕Si)⋅Hkfor i=1,…,m+n+1−kXi=∑j=1k(Xi+j−2k'⊕Si+j−k)⋅Hk−j+1.

If the length of the IV is not 96, the GHASH function is used to calculate Counter 0:

t = 32 and the maximal packet size is 2 bytes, the authentication decryption function should be invoked no more than 2 times; if n⋅2 for messages that are l = n × 128). Saarinen also described a GCM variant Sophie Germain Counter Mode (SGCM) based on Sophie Germain primes.

See also

edit

• Authenticated encryption
• Block cipher mode of operation
• AES-GCM-SIV

References

edit

RFC 9325.
1. 1 2 3 4 5 6 Kohno, Tadayoshi; Viega, John; Whiting, Doug (2004). "CWC: A High-Performance Conventional Authenticated Encryption Mode". In Roy, Bimal; Meier, Willi (eds.). Fast Software Encryption. Lecture Notes in Computer Science. Vol. 3017. Berlin, Heidelberg: Springer. pp. 408–426. doi:10.1007/978-3-540-25937-4_26. ISBN 978-3-540-25937-4.
2. 1 2 3 4 5 RFC 4106. Proposed Standard.
3. ↑ K. Igoe; J. Solinas (August 2009). AES Galois Counter Mode for the Secure Shell Transport Layer Protocol. IETF Network Working Group. doi:10.17487/RFC5647. RFC 6367. Informational. Updated by RFC 8446. Proposed Standard. Obsoletes "Algorithm Registration - Computer Security Objects Register | CSRC | CSRC". 24 May 2016.
4. ↑ Gueron, Shay; Kounavis, Michael (April 2014). "Intel Carry-Less Multiplication Instruction and its Usage for Computing the GCM Mode (Revision 2.02)" (PDF). Retrieved 2023-09-01.
5. ↑ Manley, Raymond; Gregg, David (2010). "A Program Generator for Intel AES-NI Instructions". In Gong, G.; Gupta, K.C. (eds.). Progress in Cryptology - INDOCRYPT 2010. Lecture Notes in Computer Science. Vol. 6498. Springer. pp. 311–327. doi:10.1007/978-3-642-17401-8_22. ISBN 978-3-642-17400-1.
6. ↑ McGrew, David A.; Viega, John (2004). "The Security and Performance of the Galois/counter mode (GCM) of Operation". Proceedings of INDOCRYPT 2004. Lecture Notes in Computer Science. Vol. 3348. Springer. CiteSeerX 10.1.1.1.4591. doi:10.1007/978-3-540-30556-9_27. ISBN 978-3-540-30556-9.{{cite book}}: Cite uses deprecated parameter |citeseerx= (help)
7. 1 2 Niels Ferguson, Authentication Weaknesses in GCM, 2005-05-20
8. ↑

---

View original on Wikipedia | Back | FazBrowse Home