Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
2 replaced http://crypto.stackexchange.com/ with https://crypto.stackexchange.com/
source | link

Yes, there are some advantages for CBC-HMAC over GCM. Or rather, there are some disadvantages of GCMdisadvantages of GCM.

GCM becomes more vulnerable when the authentication tag size is smaller. GCM security breaks down completely on nonce-reuse as well, which makes it less useful for random nonces, especially when the random number generator is not as secure as you'd like it to be.

As shortly mentioned in the link there are implementation and security arguments against GCM as well.


You could always use EAX mode too, although that mode hasn't been officially standardized by NIST. EAX uses AES-CMAC for calculating authenticity, so it just relies on a fast AES to be available. It has a similar AEAD interface as GCM - it's even slightly more flexible when implemented correctly. But just like CBC + HMAC it's a full two pass protocol otherwise. And then there is OCB mode, and of course Keccak in (experimental) encryption mode.

Yes, there are some advantages for CBC-HMAC over GCM. Or rather, there are some disadvantages of GCM.

GCM becomes more vulnerable when the authentication tag size is smaller. GCM security breaks down completely on nonce-reuse as well, which makes it less useful for random nonces, especially when the random number generator is not as secure as you'd like it to be.

As shortly mentioned in the link there are implementation and security arguments against GCM as well.


You could always use EAX mode too, although that mode hasn't been officially standardized by NIST. EAX uses AES-CMAC for calculating authenticity, so it just relies on a fast AES to be available. It has a similar AEAD interface as GCM - it's even slightly more flexible when implemented correctly. But just like CBC + HMAC it's a full two pass protocol otherwise. And then there is OCB mode, and of course Keccak in (experimental) encryption mode.

Yes, there are some advantages for CBC-HMAC over GCM. Or rather, there are some disadvantages of GCM.

GCM becomes more vulnerable when the authentication tag size is smaller. GCM security breaks down completely on nonce-reuse as well, which makes it less useful for random nonces, especially when the random number generator is not as secure as you'd like it to be.

As shortly mentioned in the link there are implementation and security arguments against GCM as well.


You could always use EAX mode too, although that mode hasn't been officially standardized by NIST. EAX uses AES-CMAC for calculating authenticity, so it just relies on a fast AES to be available. It has a similar AEAD interface as GCM - it's even slightly more flexible when implemented correctly. But just like CBC + HMAC it's a full two pass protocol otherwise. And then there is OCB mode, and of course Keccak in (experimental) encryption mode.

1
source | link

Yes, there are some advantages for CBC-HMAC over GCM. Or rather, there are some disadvantages of GCM.

GCM becomes more vulnerable when the authentication tag size is smaller. GCM security breaks down completely on nonce-reuse as well, which makes it less useful for random nonces, especially when the random number generator is not as secure as you'd like it to be.

As shortly mentioned in the link there are implementation and security arguments against GCM as well.


You could always use EAX mode too, although that mode hasn't been officially standardized by NIST. EAX uses AES-CMAC for calculating authenticity, so it just relies on a fast AES to be available. It has a similar AEAD interface as GCM - it's even slightly more flexible when implemented correctly. But just like CBC + HMAC it's a full two pass protocol otherwise. And then there is OCB mode, and of course Keccak in (experimental) encryption mode.