3DES over Galois Counter Mode (GCM) for authenticated encryption

Question

Is it possible to use DES or 3DES over Galois Counter Mode (GCM) to provide authenticated encryption?

I haven't seen any implementation yet.

Answer 1

According to Wikipedia,

GCM is defined for block ciphers with a block size of 128 bits.

So no, you can't use GCM with 3DES or DES, because of the 64-bit block size. You could use something similar to GCM, but it wouldn't be GCM.

Answer 2

GCM can be defined with 64-bit ciphers, see Appendix A of here: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/gcm/gcm-spec.pdf

NISTs's final GCM spec doesn't include this option. I suspect that this is because the security of GCM's MAC component depends on the difference between the number of blocks in the longest possible message and the number of elements in the polynomial field (see, e.g., here: https://eprint.iacr.org/2013/144).

Briefly, an untruncated GCM tag gives you an $m/|F|$ probability of forging (where m is the block-length of the longest possible message) and F is the field in which you evaluate the polynomial. Choosing $F = GF(2^{64})$ doesn't leave you much scope for messages before that forgery probability is quite large.