Incryptography,Galois/Counter Mode (GCM)[1] is amode of operation forsymmetric-key cryptographicblock ciphers which is widely adopted for its performance. GCM throughput rates for state-of-the-art, high-speed communication channels can be achieved with inexpensive hardware resources.[2]
The GCM algorithm provides both data authenticity (integrity) and confidentiality and belongs to the class ofauthenticated encryption with associated data (AEAD) methods. This means that as input it takes a key K, some plaintext P, and some associated data AD; it then encrypts the plaintext using the key to produce ciphertext C, and computes an authentication tag T from the ciphertext and the associated data (which remains unencrypted). A recipient with knowledge of K, upon reception of AD, C and T, can decrypt the ciphertext to recover the plaintext P and can check the tag T to ensure that neither ciphertext nor associated data were tampered with.
GCM uses a block cipher with block size 128 bits (commonlyAES-128) operated incounter mode for encryption, and uses arithmetic in theGalois field GF(2128) to compute the authentication tag; hence the name.
Galois Message Authentication Code (GMAC) is an authentication-only variant of the GCM which can form an incrementalmessage authentication code. Both GCM and GMAC can acceptinitialization vectors of arbitrary length.
Different block cipher modes of operation can have significantly different performance and efficiency characteristics, even when used with the same block cipher. GCM can take full advantage ofparallel processing and implementing GCM can make efficient use of aninstruction pipeline or a hardware pipeline. By contrast, thecipher block chaining (CBC) mode of operation incurspipeline stalls that hamper its efficiency and performance.
Like in normalcounter mode, blocks are numbered sequentially, and then this block number is combined with aninitialization vector (IV) and encrypted with a block cipherE, usuallyAES. The result of this encryption is thenXORed with theplaintext to produce theciphertext. Like all counter modes, this is essentially astream cipher, and so it is essential that a different IV is used for each stream that is encrypted.
The ciphertext blocks are considered coefficients of apolynomial which is then evaluated at a key-dependent pointH, usingfinite field arithmetic. The result is then encrypted, producing anauthentication tag that can be used to verify the integrity of the data. The encrypted text then contains the IV, ciphertext, and authentication tag.
GCM combines the well-knowncounter mode of encryption with the new Galois mode of authentication. The key feature is the ease of parallel computation of theGalois field multiplication used for authentication. This feature permits higher throughput than encryption algorithms, likeCBC, which use chaining modes. The GF(2128) field used is defined by the polynomial
The authentication tag is constructed by feeding blocks of data into the GHASH function and encrypting the result. This GHASH function is defined by
whereH =Ek(0128) is thehash key, a string of 128 zero bits encrypted using theblock cipher,A is data which is only authenticated (not encrypted),C is theciphertext,m is the number of 128-bit blocks inA (rounded up),n is the number of 128-bit blocks inC (rounded up), and the variableXi fori = 0, ...,m +n + 1 is defined below.[3]
First, the authenticated text and the cipher text are separately zero-padded to multiples of 128 bits and combined into a single messageSi:
where len(A) and len(C) are the 64-bit representations of the bit lengths ofA andC, respectively,v = len(A) mod 128 is the bit length of the final block ofA,u = len(C) mod 128 is the bit length of the final block ofC, and denotes concatenation of bit strings.
ThenXi is defined as:
The second form is an efficient iterative algorithm (eachXi depends onXi−1) produced by applyingHorner's method to the first. Only the finalXm+n+1 remains an output.
If it is necessary to parallelize the hash computation, this can be done by interleavingk times:
If the length of the IV is not 96, the GHASH function is used to calculateCounter 0:
GCM was designed byJohn Viega and David A. McGrew to be an improvement toCarter–Wegman counter mode (CWC mode).[4]
In November 2007,NIST announced the release of NIST Special Publication 800-38DRecommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC making GCM and GMAC official standards.[5]
GCM mode is used in theIEEE 802.1AE (MACsec) Ethernet security,WPA3-Enterprise Wifi security protocol,IEEE 802.11ad (also dubbedWiGig), ANSI (INCITS)Fibre Channel Security Protocols (FC-SP),IEEE P1619.1 tape storage,IETFIPsec standards,[6][7]SSH,[8]TLS 1.2[9][10] and TLS 1.3.[11] AES-GCM is included in theNSA Suite B Cryptography and its latest replacement in 2018Commercial National Security Algorithm (CNSA) suite.[12] GCM mode is used in theSoftEther VPN server and client,[13] as well asOpenVPN since version 2.4.
GCM requires one block cipher operation and one 128-bit multiplication in theGalois field per each block (128 bit) of encrypted and authenticated data. The block cipher operations are easily pipelined or parallelized; the multiplication operations are easily pipelined and can be parallelized with some modest effort (either by parallelizing the actual operation, by adaptingHorner's method per the original NIST submission, or both).
Intel has added thePCLMULQDQ instruction, highlighting its use for GCM.[14] In 2011, SPARC added the XMULX and XMULXHI instructions, which also perform 64 × 64 bitcarry-less multiplication. In 2015, SPARC added the XMPMUL instruction, which performs XOR multiplication of much larger values, up to 2048 × 2048 bit input values producing a 4096-bit result. These instructions enable fast multiplication over GF(2n), and can be used with any field representation.
Impressive performance results are published for GCM on a number of platforms. Käsper and Schwabe described a "Faster andTiming-Attack Resistant AES-GCM"[15] that achieves 10.68 cycles per byte AES-GCM authenticated encryption on 64-bit Intel processors. Dai et al. report 3.5 cycles per byte for the same algorithm when using Intel's AES-NI and PCLMULQDQ instructions.Shay Gueron andVlad Krasnov achieved 2.47 cycles per byte on the 3rd generation Intel processors. Appropriate patches were prepared for theOpenSSL andNSS libraries.[16]
When both authentication and encryption need to be performed on a message, a software implementation can achieve speed gains by overlapping the execution of those operations. Performance is increased by exploitinginstruction-level parallelism by interleaving operations. This process is called function stitching,[17] and while in principle it can be applied to any combination of cryptographic algorithms, GCM is especially suitable. Manley and Gregg[18] show the ease of optimizing when using function stitching with GCM. They present a program generator that takes an annotated C version of a cryptographic algorithm and generates code that runs well on the target processor.
GCM has been criticized in the embedded world (for example bySilicon Labs) because the parallel processing is not suited for performant use of cryptographic hardware engines. As a result, GCM reduces the performance of encryption for some of the most performance-sensitive devices.[19] Specialized hardware accelerators forChaCha20-Poly1305 are less complex compared to AES accelerators.[20]
According to the authors' statement, GCM is unencumbered by patents.[21]
GCM is proven secure in theconcrete security model.[22] It is secure when it is used with a block cipher that is indistinguishable from arandom permutation; however, security depends on choosing a uniqueinitialization vector for every encryption performed with the same key (seestream cipher attack). For any given key and initialization vector value, GCM is limited to encrypting239 − 256 bits of plain text (64 GiB). NIST Special Publication 800-38D[5] includes guidelines for initialization vector selection and limits the number of possible initialization vector values for a single key. As the security assurance of GCM degrades with more data being processed using the same key, the total number of blocks of plaintext and AD protected during the lifetime of a single key should be limited by 264.[5]
The authentication strength depends on the length of the authentication tag, like with all symmetric message authentication codes. The use of shorter authentication tags with GCM is discouraged. The bit-length of the tag, denotedt, is asecurity parameter. In general,t may be any one of the following five values: 128, 120, 112, 104, or 96. For certain applications,t may be 64 or 32, but the use of these two tag lengths constrains the length of the input data and the lifetime of the key. Appendix C in NIST SP 800-38D provides guidance for these constraints (for example, ift = 32 and the maximal packet size is 210 bytes, the authentication decryption function should be invoked no more than 211 times; ift = 64 and the maximal packet size is 215 bytes, the authentication decryption function should be invoked no more than 232 times).
Like with any message authentication code, if the adversary chooses at-bit tag at random, it is expected to be correct for given data with probability measure 2−t. With GCM, however, an adversary can increase their likelihood of success by choosing tags withn words – the total length of the ciphertext plus any additional authenticated data (AAD) – with probability measure 2−t by a factor ofn. Although, one must bear in mind that these optimal tags are still dominated by the algorithm's survival measure1 −n⋅2−t for arbitrarily larget. Moreover, GCM is neither well-suited for use with very short tag-lengths nor very long messages.
Ferguson and Saarinen independently described how an attacker can perform optimal attacks against GCM authentication, which meet the lower bound on its security. Ferguson showed that, ifn denotes the total number of blocks in the encoding (the input to the GHASH function), then there is a method of constructing a targeted ciphertext forgery that is expected to succeed with a probability of approximatelyn⋅2−t. If the tag lengtht is shorter than 128, then each successful forgery in this attack increases the probability that subsequent targeted forgeries will succeed, and leaks information about the hash subkey, H. Eventually,H may be compromised entirely and the authentication assurance is completely lost.[23]
Independent of this attack, an adversary may attempt to systematically guess many different tags for a given input to authenticated decryption and thereby increase the probability that one (or more) of them, eventually, will be considered valid. For this reason, the system or protocol that implements GCM should monitor and, if necessary, limit the number of unsuccessful verification attempts for each key.
Saarinen described GCMweak keys.[24] This work gives some valuable insights into how polynomial hash-based authentication works. More precisely, this work describes a particular way of forging a GCM message, given a valid GCM message, that works with probability of aboutn⋅2−128 for messages that aren × 128 bits long. However, this work does not show a more effective attack than was previously known; the success probability in observation 1 of this paper matches that of lemma 2 from the INDOCRYPT 2004 analysis (settingw = 128 andl =n × 128). Saarinen also described a GCM variantSophie Germain Counter Mode (SGCM) based onSophie Germain primes.
{{cite journal}}:Cite journal requires|journal= (help)