2 ms·
Ahh... I've misunderstood that extra bit, and I think it's never at the 2**128 position. I've misread the code for padding. A stop bit is used to disambiguate
by KMag 5y ago
Ahh... I've misunderstood that extra bit, and I think it's never at the 2**128 position. I've misread the code for padding. A stop bit is used to disambiguate zero padding from messages that end in zeroes, similar to most hash function message padding. How silly of me.
- tptacek 5y agoThere's several issues with GCM; the most obvious is the susceptibility to repeated nonces (notice that I compared GCM to CBC+HMAC, the most common generic composition) but there's also GCM's weakness with shortened tags, the fact that GCM relies on a multiplication operation that wants tables for efficient software implementations, and the short nonce, which makes it dicey to use random nonces and also limits how much you can encrypt. The original chapoly constructions aren't as brittle, but share the biggest problem (the nonce uniqueness requirement). But later chapoly constructions allow for wide nonces, which makes it reasonable to use fully random nonces. I don't care if people use GCM or not; I'd comfortably use it if it was the only AEAD available in my standard library. But I agree with the root comment on this thread that suggests it's a weird thing to brag about.