Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Looking at the implementation, the longer nonce is hashed to 128 bits, with the last 32 used as a starting counter. So, if you don't use the whole 32 bits space of the counter, you are effectively using more than 96 bits nonce.

Sure, no more than 128 bits, but indeed better than 96.



Right, and 128 bits is way better than 96.

The only thing to potentially be aware of is that the randomized block counter may end up overflowing if it happens to end up with a large initial value (or you encrypt large messages). That should be fine, but it's quite likely that some GCM implementations are not expecting that and either blow up when the counter resets to 0 or do something else unexpected. So although I think this is theoretically a fine thing to do, I absolutely wouldn’t trust my sensitive data to it.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: