Subject: Re: [Cfrg] GCM nonce reuse question

From: "David McGrew (mcgrew)" <[email-masked]>
Date: Thu, 28 Mar 2013 11:14:50 +0000

Hi Jim,

From: Jim Schaad <[email-masked]<mailto:[email-masked]>>
Date: Wednesday, March 27, 2013 6:43 PM
To: David McGrew <[email-masked]<mailto:[email-masked]>>
Cc: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: GCM nonce reuse question

David,

In doing a write up I became worried about a security property of the GCM encryption mode in the way that the JOSE group is currently using it.

There are known problems with not having a unique set of values for IVs and Key pairings.  Do these problems apply to having a different set of auxiliary data as well as the plain text?

Yes.  The security issues are summarized in http://tools.ietf.org/html/rfc5116#section-5.1.1  but apparently they are not described generally enough.   They should read "plaintext or associated data values".

Specifically the current way that GCM mode is being used in JOSE is

Recipient #1 authentication tag = GCM(Key, Recipient #1 data, nonce, plain text)
Recipient #2 authentication tag = GCM(Key, Recipient #2 data, nonce, plain text)

As the key, nonce and plain text are fixed it would produce the same encrypted text value but different authentication tags.

Can't do that.   Each invocation of the encryption operation needs a distinct nonce, unless all of the encryption operation inputs are identical.

Many thanks for calling this out, Jim.

David

Jim

---

From: Mike Jones <[email-masked]>
Date: Fri, 29 Mar 2013 02:06:44 +0000

I'll plan to add text to the GCM section of JWA during the current round of edits pointing this out.  David McGrew was also going to get me some text about constraints on GCM initialization vector values.

                                                            -- Mike

From: [email-masked] [mailto:[email-masked]] On Behalf Of Jim Schaad
Sent: Thursday, March 28, 2013 7:02 PM
To: [email-masked]
Subject: [jose] FW: GCM nonce reuse question

For those people not on the CFRG list -

Jim

From: David McGrew (mcgrew) [mailto:[email-masked]]
Sent: Thursday, March 28, 2013 4:15 AM
To: Jim Schaad
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: GCM nonce reuse question

Hi Jim,

David,

David

Jim