AES Galois Counter Mode (GCM) Cipher Suites for TLS

Choudhury, A.K.; McGrew, David; Salowey, Joseph

doi:10.17487/rfc5288

Cited by 83 publications

(49 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…TLS 1.2 also supports Authenticated Encryption modes, with AES-GCM and AES-CCM for TLS 1.2 being defined in [44] and [31], respectively. The former involves the use of a 12-byte IV (or nonce), of which 8 bytes are carried in each TLS record in the GenericAEADCipher.nonce explicit field.…”

Section: Defeating Asasmentioning

confidence: 99%

Security of Symmetric Encryption against Mass Surveillance

Bellare

Paterson

Rogaway

2014

Lecture Notes in Computer Science

147

208

View full text Add to dashboard Cite

Abstract. Motivated by revelations concerning population-wide surveillance of encrypted communications, we formalize and investigate the resistance of symmetric encryption schemes to mass surveillance. The focus is on algorithm-substitution attacks (ASAs), where a subverted encryption algorithm replaces the real one. We assume that the goal of "big brother" is undetectable subversion, meaning that ciphertexts produced by the subverted encryption algorithm should reveal plaintexts to big brother yet be indistinguishable to users from those produced by the real encryption scheme. We formalize security notions to capture this goal and then offer both attacks and defenses. In the first category we show that successful (from the point of view of big brother) ASAs may be mounted on a large class of common symmetric encryption schemes. In the second category we show how to design symmetric encryption schemes that avoid such attacks and meet our notion of security. The lesson that emerges is the danger of choice: randomized, stateless schemes are subject to attack while deterministic, stateful ones are not.

show abstract

Section: Defeating Asasmentioning

confidence: 99%

Security of Symmetric Encryption against Mass Surveillance

Bellare

Paterson

Rogaway

2014

Lecture Notes in Computer Science

147

208

View full text Add to dashboard Cite

show abstract

“…Salowey, A. Choudhury and D. McGrew 2008]. According to the AES-CCM specification for TLS [D. McGrew and D. Bailey 2012], the CCMNonce is a combination of a salt and a nonce explicit value.…”

Section: Handling Secure Group Requestsmentioning

confidence: 99%

Axiom

Tiloca

Nikitin²,

Raza

2017

ACM Trans. Embed. Comput. Syst.

View full text Add to dashboard Cite

MARCO TILOCA, SICS Swedish ICT AB KIRILL NIKITIN, SICS Swedish ICT AB SHAHID RAZA, SICS Swedish ICT AB This article presents Axiom, a DTLS-based approach to efficiently secure multicast group communication among IoT constrained devices. Axiom provides an adaptation of the DTLS record layer, relies on key material commonly shared among the group members, and does not require to perform any DTLS handshake. We made a proof of concept implementation of Axiom based on the tinyDTLS library for the Contiki OS, and used it to experimentally evaluate performance of our approach on real IoT hardware. Results show that Axiom is affordable on resource constrained platforms, and performs significantly better than related alternative approaches.

show abstract

“…Also, various ciphers specified for use with TLS are known to have cryptographic weaknesses regardless of key length (none of the ciphers specified in [RFC4492] and [RFC5246] can be recommended for use with False Start). The AES_128_GCM_SHA256 or AES_256_GCM_SHA384 ciphers specified in [RFC5288] and [RFC5289] can be considered sufficiently strong for most uses. Implementations that support additional cipher suites have to be careful to whitelist only suitable symmetric ciphers; if in doubt, False Start should not be used with a given symmetric cipher.…”

Section: Symmetric Ciphermentioning

confidence: 99%