3 ms·
> You're less likely to blow that up than GCM. Do you have a pointer where I can read about traps of GCM?
by weinzierl 8y ago
> You're less likely to blow that up than GCM.
Do you have a pointer where I can read about traps of GCM?
- tptacek 8y agoI don't know the best summary, but the broad strokes are that nonce reuse both destroys confidentiality and allows recovery of authentication keys --- this is an extraordinarily common problem and one attackers can sometimes induce --- as does truncating the GCM MAC, and, if you don't have hardware support for GCM (ie, x64 CLMUL), the table-based version is timable.
- deleted 8y ago[deleted]