2

I'm delivering shared secret with DH exchange, using a static key for signing and an ephemeral for session, so is there a point using GCM for encrypting the data, or is a simple CBC/CTR block cipher is enough?

Also, I'm not sure what's the point authenticating the encrypted data, since if it gets modified, it will produce garbage at decryption, or if adversary gains the key somehow they will be able to fake the authentication tag too.

Cryptographeur
  • 4,357
  • 2
  • 29
  • 40
Szotyi
  • 23
  • 3

2 Answers2

3

Unless you are absolutely sure that you don't need to and that the cost is going to be significant then I would absolutely say you should use authenticated encryption. One reason is bit-flipping attacks - flipping a few bits at the 'right' point in your encrypted message might lead well to a message that is legal (the classic example is if someone learns your message will be of the form ??<misc secret unknown format stuff>??? Send Bob ???<more unknown stuff>??? then they can xor the 'Alice' section with Bob$\oplus$Eve).

Another example that could well affect you would be a replay attack where an old message is sent again, and because you are not authenticating the messages the server wouldn't realise. There's a nice reference somewhere to an old computer game that players managed to cheat by continuously replaying the 'Killed Beast' message, but I can't find it at the moment.

You might find this question relevant.

Cryptographeur
  • 4,357
  • 2
  • 29
  • 40
1

One of the major advantages of GCM is the authenticated data input that you can pass. Think about headers of a message that you want authenticated but not encrypted. This is a great thing to have in many practical implementations where some data has to stay in clear but manipulating it by an attacker has serious consequences.

camgas
  • 31
  • 1