Announcing AES-GEM (AES with Galois Extended Mode)

Summary: Trail of Bits has proposed a new block cipher mode called Galois Extended Mode (GEM), presented at a NIST workshop on accordion mode cipher requirements, which modifies AES-GCM with a longer nonce, CBC-MAC-based subkey derivation, a 64-bit internal counter, and a key commitment value appended to the authentication tag. The proposal responds to long-documented GCM weaknesses, including nonce misuse that Hanno Böck and Sean Devlin used to inject their Black Hat USA slide deck into the MI5 website, Niels Ferguson's 2005 paper on authentication weaknesses, and an Amazon paper arguing AES's 128-bit block size is no longer sufficient.
Bottom line: AES-GCM is one of two cipher modes used by TLS 1.3 and the preferred method for encrypting data in FIPS-validated modules, so its failure modes - a 2^-32 nonce collision probability after roughly 2^32 messages with random 96-bit nonces, and short-tag forgeries that reveal the authentication subkey - sit underneath a large share of encrypted traffic; the author states the current GEM design is not ready for production use.

Read the original at Trail of Bits Blog ↗