4 ms·
If you reuse a nonce, even once, then any message can be forged with GCM. HMAC doesn't have this issue, but also doesn't handle nonces natively, which the confi
by wbl 13y ago
If you reuse a nonce, even once, then any message can be forged with GCM. HMAC doesn't have this issue, but also doesn't handle nonces natively, which the confidentiality loss for both is the same. On devices which never reuse secret keys across power cycles this is probably not a problem, but it can be in some environments.
- tptacek 13y agoColin recommends CTR+HMAC, which has exactly the same problem. I don't think that's what he's referring to.
- wbl 13y agoThey both have exactly the same confidentiality issue (because both use CTR mode) but the forgery issue is specific to GCM as a single successful forgery leads to infinitely many. With truncated tags this is a real issue. But with big tags both have pretty much the same "good for counting, terrible if you can't" behaviour.