16

The Galois Counter Mode

In the previous chapter, we learned about authenticated encryption and authenticated encryption with additional data. We saw how authenticated encryption can be obtained from simpler cryptographic primitives using generic composition, and we introduced a dedicated counter mode with CBC-MAC (CCM) that provides AEAD.

In TLS 1.3, AEAD is used for protecting all TLS Record protocol payloads. In this chapter, we will study Galois/Counter Mode (GCM), an AEAD algorithm that every TLS 1.3 endpoint must implement. RFC 8446 [147], the specification of TLS 1.3, only references NIST’s Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC [57], where GCM is specified. But since GCM is used in the TLS Record protocol, the material we will discuss in this chapter is related to Chapter 5, Record Protocol, of RFC 8446.

Upon completion of the chapter, you will be familiar with GCM’s mathematical foundations, architecture...

16.1 Preliminaries

According to the American security researchers David McGrew and John Viega, ”the Galois/Counter Mode is a block cipher mode of operation that uses universal hashing over a binary Galois field to provide authenticated encryption [114].”

Before studying the internals of the algorithm, we need to quickly cover two mathematical aspects: the finite field used by GCM and the way multiplication is done in that finite field.

16.1.1 The Galois field 𝔽_2¹²⁸

GCM uses multiplication over a finite field. In mathematics, finite fields are also referred to as Galois fields in honor of the 19th-century French mathematician Evariste Galois, hence the name Galois counter mode.

We have already encountered finite fields in section 7.6 Finite Fields in Chapter 7, Public-Key Cryptography. You may go back to that section to refresh your memory, but we are repeating the basic facts here for your convenience.

The field used in GCM has 2¹²⁸ elements, which...

16.2 GCM security

GCM’s biggest security risk is its fragility in case of nonce repetition. NIST’s GCM standard [57] requires the following:

The probability that the authenticated encryption function ever will be invoked with the same IV and the same key on two (or more) distinct sets of input data shall be no greater than 2⁻³².

Moreover, care must be taken that the nonces do not repeat: if the same nonce N is used twice in an AES-GCM computation, an attacker would be able to compute the authentication key H. With the help of H, tags for any ciphertext, associated data, or both can be fabricated.

This is easy to see with a little bit of math. The authentication tag is computed as:

Now, if we have two tags T₁ and T₂ computed with the same nonce N, we can XOR T₁ and T₂ to obtain the following expression:

Because x ⊕ x = 0, the term E_K(N∥0) (the AES encryption of N∥0 under the secret key K) will vanish. As a result, the attacker obtains...

16.3 GCM performance

There is an old saying among cryptographers that the real challenge is not to design a secure algorithm, but one that is secure and fast. While this is typically said somewhat jokingly, there is a lot to this saying. Take, for instance, ciphers. It is well known that the composition of functions illustrated in Figure 16.2 can be used to define complicated functions using simpler ones.

Recall that if f : X → Y and g : Y → Z are functions, then the composition of g with f, denoted by g ∘f, is a function mapping elements of X to elements of Z. Moreover, the composition can be extended to any number of functions f₁,f₂,…,f_n (resulting in the composition f_n ∘…∘f₂ ∘f₁) given that the domain of f_t equals the co-domain of f_t−1.

Figure 16.2: Composition g ∘ f of functions g and f

In cryptography, ciphers combining a sequence of simpler transformations are called product ciphers. So, based on...

16.4 Summary

In this chapter, we studied GCM – the default, mandatory-to-implement authenticated encryption with additional data algorithm used in TLS 1.3. We covered the GCM design and working principles, and we discussed its security.

Moreover, we looked into GCM performance – and why the performance of cryptographic algorithms matters in general – and learned how to benchmark authenticated encryption algorithms covered in this book using OpenSSL.

In the next chapter, we will zoom out of technical and mathematical details and revisit the TLS Record protocol from a higher-level, conceptual perspective. The aim of the next chapter is to understand how the individual cryptographic mechanisms we covered so far fit together to ensure the confidentiality and integrity of data transmitted in TLS records.