0

I'm using AES-256 CBC mode in C# to encrypt various amounts of texts. The key and IV are always generated properly randomly. However, would GCM mode provide any noticeable security gains over CBC?

  • GCM provides authenticity. CBC is malleable. – AndrolGenhald Jun 22 '18 at 14:16
  • @AndrolGenhald It must be a huge factor in that case. – Azxdreuwa Jun 22 '18 at 14:18
  • What do you mean by "huge factor"? – AndrolGenhald Jun 22 '18 at 14:24
  • @AndrolGenhald In choosing GCM over CBC. – Azxdreuwa Jun 22 '18 at 14:40
  • 1
    But what do you consider to be a huge factor? Malleability could be devastating in some cases, in others confidentiality is all that's required and authenticity is unneeded. – AndrolGenhald Jun 22 '18 at 14:41
1

It's a little hard to say without knowing your exact set-up, but CBC may well be fine, especially as it is available in .NET as is.

The main risk of CBC is the padding oracle attack here are some good links:

https://blog.cloudflare.com/padding-oracles-and-the-decline-of-cbc-mode-ciphersuites/

https://docs.microsoft.com/en-us/dotnet/standard/security/vulnerabilities-cbc-mode

If you can be confident that an attacker cannot modify the cipher text then you should be alright. You could also go down the route of encrypt-then-MAC to ensure that the actual ciphertext was unaltered.

  • Thank you. As it stands now, I'm not using any padding with my CBC mode. I'm simply only encrypting text, and there's absolutely no reuse of keys and IVs at all, so the output data is nonsense is multiples. Is padding stongly encouraged or can one do without it? – Azxdreuwa Jun 22 '18 at 15:47
  • Padding is a requirement of a block cipher unless your plaintext size is fixed and equal to the cipher block size. You may not realize your are even using it if your implementation chooses a default value – ste-fu Jun 22 '18 at 19:51
  • Personally do you believe it safe to stick with ISO10126 padding mode and do an encrypt-then-MAC, or just pad? – Azxdreuwa Jun 22 '18 at 20:39
  • I believe encrypt then MAC is considered generally safe, but it's hard to speak in absolutes – ste-fu Jun 23 '18 at 18:29
  • ended up switching to XSalsa20-Poly1305, looks like a great alternative. – Azxdreuwa Jun 23 '18 at 21:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.