openssl EVP_aes_256_gcm - what's inside?

Question

I have been reading about encrypting and authentication. Traveled the path from home made authentication to encrypt-then-mac approach and finally settled on GCM mode.

I am curious what resided inside aes_256_gcm. What is obvious from the name: AES algo and 256bit key length. IV len I could figure out from EVP_CIPHER_iv_length() call = 12 (I can change that with ctrl) Block size I could figure out from EVP_CIPHER_block_size() = 1

But what about "operation mode", CBC, OFB, CFB, other ? In what mode does the GCM runs ? Can I select the mode ?

Answer 1

The Wikipedia page has some explanations and a nice schematic; and the GCM standard is reasonably clear. To make things simple, the actual encryption is done in CTR mode, but the MAC part uses extra operations (multiplications in a finite field of characteristic 2, and one extra block encryption). If you encrypt 16n bytes, you will use n+1 AES block encryption invocations, n+2 multiplications in GF(2¹²⁸), and some XOR. It is not required to understand how GCM works internally to use an implementation of GCM; but it helps.

In particular, the IV can have about any possible length, but IV values beyond 96 bits are not really interesting for security, which is why OpenSSL will restrict itself to 12 bytes. The "block size" advertised by OpenSSL is 1 because, thanks to the internal use of CTR, encrypted message size will not be "rounded" due to some padding (there is a fixed size overhead, though, for the MAC).

Answer 2

Galois/Counter Mode is a mode of operation in its own right. From that document, GCM takes a primitive (e.g. AES) and adds the two galois functions:

The two functions that comprise GCM are called authenticated encryption and authenticated decryption. The authenticated encryption function encrypts the confidential data and computes an authentication tag on both the confidential data and any additional, non-confidential data. The authenticated decryption function decrypts the confidential data, contingent on the verification of the tag.

These functions are defined later in the document. Notably, the function GCTR looks very similar indeed to standard Counter mode, on which it is based and gets its name. To this mode, it adds authenticated encryption and decryption baked right in.

This alleviates the need to perform encrypt-then-mac yourself, since data that fails authentication cannot be decrypted.