92

I am trying to learn more about GCM mode and how it differs from CBC. I already know that GCM provides a MAC, which is used for message authentication. From what I have read and from the code snippets I've seen, GCM does an exclusive-or much like CBC, but I'm unsure what the exclusive-or is against.

In CBC mode, the exclusive-or is plaintext against the previous ciphertext block, except for the first block, which uses a random IV. Does GCM do the same, or does it do the exclusive-or against something else? If so, can someone please briefly explain how GCM uses the IV and how the exclusive-or is done.

Patriot
  • 3,132
  • 3
  • 18
  • 65
Bob Bryan
  • 1,283
  • 2
  • 10
  • 11
  • 6
    If you disregard authentication, GCM behaves like CTR mode, not like CBC mode. Look those up on wikipedia. – CodesInChaos Apr 08 '12 at 23:30
  • 9
    Just because it isn't defined on this page... GCM = Galois/Counter Mode, and CBC = Cipher Block Chaining... other definitions include MAC (Message Authentication Code), IV (Initialisation Vector), and CTR (CounTeR Mode). – Craig Francis Mar 04 '16 at 10:53

2 Answers2

108

GCM and CBC modes internally work quite differently; they both involve a block cipher and an exclusive-or, but they use them in different ways.

In CBC mode, you encrypt a block of data by taking the current plaintext block and exclusive-oring that wth the previous ciphertext block (or IV), and then sending the result of that through the block cipher; the output of the block cipher is the ciphertext block.

GCM mode provides both privacy (encryption) and integrity. To provide encryption, GCM maintains a counter; for each block of data, it sends the current value of the counter through the block cipher. Then, it takes the output of the block cipher, and exclusive or's that with the plaintext to form the ciphertext.

Note two key differences:

  • What's being exclusive-or'ed; in CBC mode, the plaintext is exclusive-or'ed with data that the attacker knows (the IV or a previous ciphertext block); hence, that in itself does not provide any inherent security (instead, we do it to minimize the chance that we send the same block twice through the block cipher). In GCM mode, the plaintext is exclusive-or'ed with output from the block cipher; it is inherent in the security model that the attacker cannot guess that output (unless he already knows the plaintext and the ciphertext).

  • What's being sent through the block cipher; in CBC mode, the plaintext is sent through the block cipher (after it's been 'randomized' with an exclusive-or); in GCM mode, what's being sent through the block cipher doesn't actually depend on the data being encrypted, but instead only on internal state.

As for how GCM uses an IV (I personally consider 'nonce' a better term for what GCM uses, because that emphesizes the idea that with GCM, you cannot use the same nonce for the same key twice), well, it is used to initialize the counter.

poncho
  • 147,019
  • 11
  • 229
  • 360
  • 2
    Very interesting... If I understand correctly, you are saying that in GCM mode the ciphertext of a block is exlusive-or'ed against the plaintext that was just put through the cipher and that block is then sent. If this is true, then how is that block decrypted? Isn't the ciphertext from the AES (for example) encryption required to decrypt the data? How is that obtained? Also, if the original encrypted text is obtained, then it could be used to exclusive-or the sent ciphertext which would return the plaintext and would not need further decryption... I'm missing something... – Bob Bryan Apr 09 '12 at 04:23
  • 6
    No, in GCM, we take a counter, send that through the block cipher, and then exclusive-or that with the plaintext to form the ciphertext. On the decryption side, we maintain the same counter, send that through the block cipher, and then exclusive-or that with the ciphertext to form the plaintext. – poncho Apr 09 '12 at 12:41
  • 1
    @poncho So in GCM we don’t need the “decryption” part of the block cipher? Because we use “encryption” on both side. – Franklin Yu Feb 28 '18 at 04:51
  • @FranklinYu: that is correct – poncho Feb 28 '18 at 13:40
  • 2
    If you use the same nonce twice with the same key, you open yourself up to ... what attack? – Robert Siemer Apr 19 '18 at 00:38
  • 3
    @RobertSiemer: two attacks: a) the attacker gains a significant amount of information of the two messages encrypted with the same nonce (possibly enough to deduce both contents), and b) the attack gains information that would allow him to alter messages without being detected – poncho Apr 19 '18 at 13:18
  • @poncho Note: IV is required to be random which is crucial for encryption schemes to achieve semantic security. Re-using the IV makes it systematic. Thus, the second time you use the same IV, it would be no longer an IV. In the other hand, a nonce is not required to be random. It can an arbitrary value e.g. "nonce number two" which is not random. – Elis Byberi Mar 06 '20 at 14:09
  • Doesn't this mean that if the first block of plaintext is known or can be guessed, that the whole thing can be unraveled? – David A. Gray May 02 '20 at 15:40
  • @DavidA.Gray: no, it doesn't (either for CBC or GCM); in fact, the attacker could know all but one of the bits of the plaintext, and he still won't be able to recover that last bit. How did you come to the conclusion that knowing the first block of plaintext would allow him to deduce anything more? – poncho May 02 '20 at 15:50
0

As we know, Common method for encrypting data is to divide a plaintext in the blocks and xor the plaintext with a pseudo random string, this is what CBC does.

In GCM, IV is 96 bit which is a nonce, so first counter block is IV followed by 32 bit number '1'. ${IV \parallel 1}$, here the pseudo random string is generated by the encrypting(here AES 256) the o/p of a counter, and then xor with the plain text, and gives you cipher text. So, it can encrpyt ${2^{32}}$ blocks of data, before the counter loop over again. Now if you want to just encrypt the data we're done. But if you need integrity of cipher text then you can use GMAC, where feed the cipher text into an XOR and then into a hashing function, feed that o/p to next block of XOR (cipher text XOR hash of privious block), and so on. for fisrt block 128 bit of '0' is encrpted with key and hash and become the input of XOR function. for last block length of plaintext also XORed with last Hash and then that Hash is XORed with encrypted ${IV||0^{32}}$.

Usually, when people talk about GCM that talk about GCM and GMAC togather.

CBC alone is insecure and superseded by GCM in TLS1.2 and removed in TLS1.3.

  • Below is a one block of plaintext encrypted with GCM

Below is a one block of plaintext encrypted with GCM

SSA
  • 640
  • 5
  • 11