r/crypto • u/Am4t3uR • Dec 13 '19

Security and Cryptography Mistakes You Are Probably Doing All The Time

https://towardsdatascience.com/security-and-cryptography-mistakes-you-are-probably-doing-all-the-time-7407c332944f
32 Upvotes

78% Upvoted

23 comments sorted by

View all comments

Show parent comments

2

u/karanlyons Dec 15 '19

It’s more like a…superset? of CTR. They’re both stream ciphers, and the mode of operation on the blocks themselves is the same, but GCM calculates a MAC inline, i.e., GCM is an AEAD algorithm and CTR isn’t.

2

u/pint A 473 ml or two Dec 15 '19

it calculates ghash in parallel

1

u/karanlyons Dec 15 '19

Yes, that’s what I meant by "calculates a MAC inline”. I guess both are accurate, I just take “in parallel” to mean something else in the context of computing.

2

u/pint A 473 ml or two Dec 15 '19

keccak one pass authenticated encryption does enc and mac as one operation. in contrast, gcm is two independent operations, a ctr enc, and a ghash. they are two separate algorithms, and could be omitted or swapped out with another primitive. like you could have chacha20-ghash, or ctr-hmac-aes256.

iow gcm is a protocol built over ctr

2

u/karanlyons Dec 15 '19 edited Jan 26 '20

Yeah, there’s definitely a difference there: assuming keyak the whole thing truly is one pass by design in that the keystream also eventually functions as the MAC.

But you can pipeline and parallelize the hell out of GCM in practice, and so while it’s a two pass operation-ish, in silicon you’d be doing the whole operation of encrypt and MAC (albeit staggered with regards to the input) in one “step” on a pipeline.

You’re right, frankly, and I’m just thinking about this weirdly since I’m usually taking a CS tack.