Some block cipher keys are weak when used with GCM; see this question. This happens when the multiplier $H$ decided by the key ends up in a small-order subgroup of $\mathbb{F}_{2^{128}}$. Poly1305 has a very similar structure to GHASH. It's the same idea: add in a block, then multiply by a key-...
10:38 AM
8
There are many papers out there that show that a message authenticated and encrypted by AES-GCM can be forged if the used key is weak (e.g. by Handschuh and Preneel, Saarinen or Procter and Cid). With weak keys I refer to the definition given by Handschuh and Preneel: In symmetric cryptology...
8 hours later…
6:42 PM
If you mean that the terminology "weak keys" is inappropriate and that these phenomena do not represent a serious cryptographic deficiency, then I agree. We have been in this state of affairs at least since the "week keys" work on DES.
7:42 PM
It's not that they don't represent a serious cryptographic deficiency. It's that they don't represent any deficiency whatsoever in the very simple security guarantee: the forgery probability for Poly1305 after n attempts is bounded by n*L/2^106, full stop, end of story, no if's and's or but's, no caveats or footnotes; and people keep getting misled by this specious series of papers about irrelevant algebraic structure into the misapprehension that they imply security concerns.
mjos recommends replacing the binary field GF(2^128) by the prime field GF(2^128 + 12451) in AES-GCM, which has no improvement whatsoever on the security guarantee (other than a negligible change to the denominator), and completely changes all the implementation and deployment issues (terrible choice of prime!). It's like suggesting that because you might accidentally stab your eye out with a fork while eating salad, you should tune instruments with a tuning spoon instead of a tuning fork.
« first day (3711 days earlier) ← previous day next day → last day (970 days later) »
Transcript for
Sep7
Sep '219
Sep12
The Side Channel
Mostly randomly generated noise. – crypto.stackexchange.com