Security analysis of GCM for communication. Issue 5 (30th May 2013)

• Record Type: Journal Article
• Authors: Yap, Wun‐She; Yeo, Sze Ling; Heng, Swee‐Huay; Henricksen, Matt
• Is Part Of: Security and communication networks. Volume 7:Issue 5(2014:May)
• Page Start: 854
• Page End: 864
• Publication Date: 2013-05-30
• Subjects: Computer networks -- Security measures -- Periodicals; Computer security -- Periodicals; Cryptography -- Periodicals; 005.805
• DOI: 10.1002/sec.798
• Languages: English
• ISSNs: 1939-0114

Abstract

<abstract abstract-type="main" id="sec798-abs-0001"> <title>ABSTRACT</title> <p id="sec798-para-0001">The Galois/Counter Mode of operations (GCM) is constructed by combining the counter mode encryption and the authentication component (i.e., GTAG) to provide both privacy and authenticity. GTAG can be used as a stand‐alone message authentication code. In this paper, we analyze the security of GTAG and GCM with respect to the forgery and distinguishing attacks. More precisely, <list list-type="order"><list-item><p id="sec798-para-0002">We generalize the set of weak key classes proposed by Saarinen in FSE 2012 to include all subsets of nonzero keys. Hence, we remove the condition on the smoothness of 2<sup><italic>n</italic></sup> − 1, where <italic>n</italic> denotes the block size, for the existence of weak key classes.</p></list-item><list-item><p id="sec798-para-0003">By considering powers of suitable field elements and linearized polynomials, we further exploit some specific weak key classes to present a universal forgery attack on GTAG.</p></list-item><list-item><p id="sec798-para-0004">By invoking the birthday paradox arguments, we show that a chosen message attack can be used to distinguish GTAG from a random function.</p></list-item><list-item><p id="sec798-para-0005">To relax the assumptions required in the universal forgery attack, we show that we can utilize the uniqueness of the counter mode encryption to launch a known ciphertext attack against GCM itself when the initial vector is restricted to 96 bits.</p></list-item></list></p> <p id="sec798-para-0006">The first three attacks can be applied to other Wegman–Carter polynomial message authentication codes. Copyright © 2013 John Wiley & Sons, Ltd.</p> </abstract>