4 ms·
Well, in comparison, there are plenty of opportunities for grave mistakes with AES-GCM.
by tedunangst 9y ago
Well, in comparison, there are plenty of opportunities for grave mistakes with AES-GCM.
- azinman2 9y agoPointers?
- wolf550e 9y agoNonce reuse
- kaoD 9y agoWell that's a gotcha on AES-CTR too. GP is asking about mistakes that could happen on AES-GCM that won't happen with AES-CTR+HMAC. I'm no crypto expert, but I'd say there are more opportunities of messing up with AES-CTR+HMAC like forgetting to MAC the IV.
- tedunangst 9y agoNonce reuse for CTR gives you the plaintext of those messages. (Well, the XOR of them, from which you can probably figure out the rest.) Nonce reuse for GCM gives up the key.
- azinman2 9y agoIsn’t that a gotcha for anytime you’d use a nonce? Meanwhile PubNub is using a hard coded IV on every message in ECB and CBC modes :) https://github.com/pubnub/javascript/blob/master/src/core/components/cryptography/index.js https://github.com/pubnub/javascript/blob/master/src/core/co...