The DOI matches its Crossref record, with a small difference in title or year; 8 of the 8 references it cites were found in a registry or an index; none of the 11 sources its claims cite is checked for support yet.
Recommendation for block cipher modes of operation :
Open accessAbstract
Reports on Information Security TechnologyThe Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure.ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology.ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems.This Special Publication 800-series reports on ITL's research, guidance, and outreach efforts in computer security, and its collaborative activities with industry, government, and academic organizations.Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately.Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose.
Overview
AI snapshot
Written from the paper’s full text.
TL;DR
NIST Special Publication 800-38D specifies Galois/Counter Mode (GCM), an authenticated encryption mode constructed from an approved 128-bit block cipher such as AES, together with its authentication-only specialization GMAC. It defines the algorithms, the critical IV/key uniqueness requirement, and constraints on tag lengths and invocation counts.
Key findings
- GCM combines confidentiality via a variant of Counter mode with authenticity via GHASH, a universal hash over a binary Galois field; input limits are len(P) ≤ 2³⁹−256 bits, len(A) ≤ 2⁶⁴−1 bits, and 1 ≤ len(IV) ≤ 2⁶⁴−1 bits, with all lengths required to be multiples of 8.
- Supported tag lengths are 128, 120, 112, 104, or 96 bits in general; 64- and 32-bit tags are permitted only under Appendix C constraints. For 32-bit tags, a maximum combined ciphertext+AAD of 2⁵ bytes allows 2²² invocations, down to 2¹⁰ bytes allowing 2¹¹ invocations; for 64-bit tags, 2¹⁵ bytes allows 2³² invocations, down to 2²⁵ bytes allowing 2¹⁷ invocations.
- The IV uniqueness requirement states the probability that the authenticated encryption function is ever invoked with the same IV and key on two or more distinct input sets shall be no greater than 2⁻³²; a single repeated IV may expose the implementation to forgery attacks (Joux), and the document says this requirement is "almost as important as the secrecy of the key."
- Unless an implementation uses only 96-bit IVs from the deterministic construction, total invocations of authenticated encryption shall not exceed 2³² across all IV lengths and instances with a given key; a reasonable overall limit of 2⁶⁴ blocks of plaintext and AAD per key is suggested.
Methods
- This is a standards specification, not an empirical study: it defines Algorithms 1–5 (block multiplication over GF(2¹²⁸), GHASH, GCTR, GCM authenticated encryption, and GCM authenticated decryption), with inputs, outputs, steps, diagrams, and summaries.
- It specifies requirements for the underlying block cipher (approved, 128-bit block size, key ≥128 bits, fresh and secret), two IV construction frameworks (deterministic and RBG-based), key establishment, and conformance categories (GCM and GMAC).
- No data, sample, or statistical analysis is reported; the document is normative guidance with appendices summarizing security rationale and short-tag constraints.
Limitations
- Stated: authentication assurance is "strong, but not absolute" — a targeted ciphertext forgery is expected to succeed with probability approximately n/2ᵗ, where n is the total number of blocks in the GHASH encoding of ciphertext and AAD, so GCM is "not well-suited for use with short tag lengths or very long messages," and each successful forgery increases the probability of subsequent ones and leaks information about the hash subkey H.
- Stated: GCM does not inherently prevent replay of a valid authenticated-encryption output; the controlling protocol must monitor IV duplication or incorporate identifying information (e.g., sequence numbers, timestamps) into the AAD.
- Stated: the simplified GHASH in this Recommendation does not obtain all of the properties shown for the designers' definition of GHASH in Ref. [7]; also, security assurance degrades as more data is processed with a single key.
Model-written summary. Check it against the paper before relying on it.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
45 Own interpretation · 11 Sources not found · 10 No basis given
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In other words, the adversary essentially could control the plaintext output of the authenticated decryption function.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
hedgeddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Independent of this attack, an adversary may attempt to systematically guess many different tags for a given input to authenticated decryption, and thereby increase the probability that one (or more) of them, eventually, will be accepted as valid.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“If the output is FAIL, then it is certain that at least one of the given inputs (i.e., the ciphertext, the AAD, the IV, or the tag) is not authentic.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Compliance with this requirement is crucial to the security of GCM.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 8 Uniqueness Requirement on IVs and Keys
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Rests on an assumption: The underlying approved block cipher is secure.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Moreover, each successful forgery in this attack 1) increases the probability that subsequent targeted forgeries will succeed, and 2) leaks information about the hash subkey, H.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The adversary then could easily construct a ciphertext forgery.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
hedgeddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
In the paper
“For the RBG-based construction of IVs, the above requirement, in conjunction with the requirement that r(i)≥96, is sufficient to ensure the uniqueness requirement in Sec. 8, as follows from the discussion in Ref. [4].”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 8.3 Constraints on the Number of Invocations
What the sources say
- Not matchedcites [4]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Not matched
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In other words, an adversary, i.e., a party without access to the key or to the authenticated encryption function, may be able to produce the correct tag for some triple of ciphertext, AAD, and IV.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In other words, GCM, like many other authentication mechanisms, does not inherently prevent an adversary from intercepting the output of an invocation of authenticated encryption and”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In the above scenario, knowing the original plaintext that corresponds to the given ciphertext, the adversary can construct the substitute ciphertext in such a way as to correspond to any desired plaintext of the same length.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Probably not a substantial claim. 30
- It may state two separate claims as one. 7
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“GCM provides assurance of the confidentiality of data using a variation of the Counter mode of operation for encryption.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 3 Introduction
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
- Rests on an assumption: The underlying approved block cipher is secure.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The hash subkey, denoted H, is generated by applying the block cipher to the”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 5.3 Primitives for Confidentiality and Authentication
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Compliance with these two requirements implies compliance with the uniqueness requirement on IVs in Sec. 8.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“GCM can also provide authentication assurance for additional data (of practically unlimited length per invocation) that is not encrypted.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 3 Introduction
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
- Rests on an assumption: The underlying approved block cipher is secure.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“As described in Appendix B, the successful verification of the tag within the authenticated decryption function gives assurance of the authenticity of the data; however, the party that presents the input data to the authenticated decryption function may not be the original source of the plaintext and AAD.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
plainconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Each of these functions is relatively efficient and parallelizable; consequently, high-throughput implementations are possible in both hardware and software.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 3 Introduction
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Consequently, GCM is not well-suited for use with short tag lengths or very long messages.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“For some voice or video applications, short authentication tags can be appropriate.The forgery of some fraction of the individual authenticated”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
plainconditional- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence. The paper’s conclusions may not depend on it.
In the paper
“The mechanism for the confidentiality of the plaintext within GCM is a variation of the Counter mode [10], with a particular incrementing function, denoted inc 32 , for generating the necessary sequence of counter blocks.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 5.3 Primitives for Confidentiality and Authentication
What the sources say
- Not matchedcites [10]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Not matched
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The secure operation of a cryptographic algorithm depends not only on the proper implementation of the steps of the algorithm, but also on the adherence to the associated requirements.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In some protocols an adversary may even be able to use data that the verifier itself generated earlier in the protocol.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In practice, the requirements in Sec.5.1 should ensure that a key is fresh when it is generated, if the generation mechanism is resistant to tampering.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 8.1 Key Establishment
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The authentication mechanism within GCM is based on a hash function, called GHASHfoot_0 , that features multiplication by a fixed parameter, called the hash subkey, within a binary Galois field.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 5.3 Primitives for Confidentiality and Authentication
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“GCM provides stronger authentication assurance than a (non-cryptographic) checksum or error detecting code; in particular, GCM can detect both 1) accidental modifications of the data and 2) intentional, unauthorized modifications.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 3 Introduction
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may state two separate claims as one.
- Rests on an assumption: The underlying approved block cipher is secure.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“In effect, the GHASH function calculates X 1 •H m ⊕ X 2 •H m-1 ⊕ ... ⊕ X m-1 •H 2 ⊕ X m •H.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Output: block GHASH H (X).
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The GCM functions require only the forward direction of the underlying block cipher (i.e., the inverse direction is not required).”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 3 Introduction
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The • operation on (pairs of) the 2 128 possible blocks corresponds to the multiplication operation for the binary Galois (finite) field of 2 128 elements.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Steps:
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In practice, this requirement is almost as important as the secrecy of the key.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 8 Uniqueness Requirement on IVs and Keys
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
- Rests on an assumption: The underlying approved block cipher is secure.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The GCM functions are”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 3 Introduction
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“If some or all of the additional, non-confidential data is fixed, then the corresponding elements of the GCM authentication mechanism can be pre-computed.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 3 Introduction
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“GHASH is a keyed hash function but not, on its own, a cryptographic hash function.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 5.3 Primitives for Confidentiality and Authentication
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“For GCM, the requirement in Sec.5.2.1 for the uniqueness of the IVs is almost as important, although not as obvious.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“If the output is the plaintext, then the design of the mode provides strong, but not absolute, assurance that the purported source of the data created the tag, i.e., that the plaintext and the AAD (and the IV and the tag) are authentic.Consequently, the mode also provides strong assurance that this information was not subsequently altered, either intentionally or unintentionally.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
boostedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“For example, GCM keys may be established using the key derivation functions of the following protocols as allowed in [9]: Transport Layer Security, Internet Key Exchange v1 and v2, and Secure Shell.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 8.1 Key Establishment
What the sources say
- Not matchedcites [9]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Not matched
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The authenticity of the protected data can be verified independently from the recovery of the confidential data from its encrypted form.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 3 Introduction
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“GCM does not employ the inverse cipher function.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 5.1 Block Cipher
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Eventually, H may be compromised entirely, with consequences as described at the end of Appendix A: the authentication assurance is completely lost.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“As with any tag-based authentication mechanism, if the adversary chooses a t-bit tag at random, it is expected to be correct for given data with probability 1/2 t .”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“If the unique initialization string is predictable, and the length of the confidential data is known, then the block cipher invocations within the GCM encryption mechanism can be pre-computed.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 3 Introduction
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Moreover, as with most block cipher modes of operation, the security assurance of GCM degrades as more data is processed with a single key.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 10 Conformance
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The creation of an authentication tag by the authenticated encryption function provides the mechanism whereby assurance of the authenticity of the plaintext and AAD (and IV) can be obtained upon the execution of the authenticated decryption function.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“One potential advantage of the RBG-based construction is that the RBG may be designed to recover from a loss of power in a straightforward manner, i.e., without requiring action from the IT professional that maintains the system.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 9.1 Design Considerations
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Compliance with the uniqueness requirement on IVs, and hence the security of GCM, ultimately depends on the IT professional who configures, deploys, and maintains the GCM modules within a particular system.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 9.2 Operational Considerations
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“For the deterministic construction, all of the deterministic elements that are necessary to construct the IV would have to be available when power is restored.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 9.1 Design Considerations
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper relies on this without support.
The underlying approved block cipher is secure.
“GCM is constructed from an approved symmetric key block cipher with a block size of 128 bits, such as the Advanced Encryption Standard (AES) algorithm that is specified in Federal Information Processing Standard (FIPS) Pub.197 [2].”
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“To eliminate the risk of nonce reuse, the framework employs a stochastic generation approach compliant with NIST SP 800-38D guidelines (Dworkin, 2007).”
From A high-throughput AES-GCM implementation on GPUs for secure, policy-based access to massive astronomical catalogs (2026) · cites this paper as Dworkin, 2007
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Archives approaching N ∼ 2 32 files per key fall into the regime where NIST SP 800-38D §8.3 recommends key rotation; our framework supports this through the explicit key reference required by every encryption operation.”
From A high-throughput AES-GCM implementation on GPUs for secure, policy-based access to massive astronomical catalogs (2026) · cites this paper as Dworkin, 2007
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Third, standardization: AES-GCM is specified by NIST SP 800-38D (Dworkin, 2007) as an approved AEAD mode, whereas CTR + HMAC, although built from approved primitives, is not itself a standardized AEAD construction.”
From A high-throughput AES-GCM implementation on GPUs for secure, policy-based access to massive astronomical catalogs (2026) · cites this paper as Dworkin, 2007
Experimental — accuracy not yet measuredThe cited source says what the claim attributes to it.
In the citing paper
“The framework implements the AES-128-GCM standard (Dworkin, 2007).”
From A high-throughput AES-GCM implementation on GPUs for secure, policy-based access to massive astronomical catalogs (2026) · cites this paper as Dworkin, 2007
The cited source says what the claim attributes to it.
In the citing paper
“The security of the AES-GCM mode relies strictly on the uniqueness of the initialization vector for a given key.”
From A high-throughput AES-GCM implementation on GPUs for secure, policy-based access to massive astronomical catalogs (2026) · cites this paper as Dworkin, 2007
Citations
Cites
THE ADVANCED ENCRYPTION STANDARD
Stallings, W. (2002) · Cryptologia · doi:10.1080/0161-110291890876 · Cited by 770
Recommendation for block cipher modes of operation: methods and techniques
Dworkin, M. J. (2001) · doi:10.6028/nist.sp.800-38a · Cited by 746
Self-citationThe Security and Performance of the Galois/Counter Mode (GCM) of Operation
McGrew, D. A., & Viega, J. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-30556-9_27 · Cited by 530 · cited 1×
“[7] gives a detailed treatment of the security properties of GCM.”
BackgroundSecurity Requirements for Cryptographic Modules
Daley, W. M., Shavers, C., & Kammer, R. G. (1999) · Defense Technical Information Center (DTIC) · Cited by 405
The Galois/Counter Mode of Operation (GCM)
McGrew, D. A., & Viega, J. (2005) · Cited by 332
Security Requirements for Cryptographic Modules
National Institute of Standards and Technology (US) (2019) · Federal Information Processing Standards Publication (FIPS PUB) 140-3 · doi:10.6028/nist.fips.140-3 · Cited by 118
The Advanced Encryption Standard (AES)
Paar, C., & Pelzl, J. (2009) · Springer eBooks · doi:10.1007/978-3-642-04101-3_4 · Cited by 80
Research works printed but not linked: 1
- IEEE P1619.1™/D23, Draft Standard for Authenticated Encryption with Length Expansion for Storage Devices.
Cited by
Sorted by citations
Report on lightweight cryptography
McKay, K. A., Bassham, L., Turan, M. S., & Mouha, N. (2017) · doi:10.6028/nist.ir.8114 · Cited by 353
“NIST also approves standalone MACs, CMAC [19], GMAC [17], and HMAC [68], to be used for generating and verifying tags to provide message authentication.”
MethodInfluentialThe Software Performance of Authenticated-Encryption Modes
Krovetz, T., & Rogaway, P. (2011) · Lecture notes in computer science · doi:10.1007/978-3-642-21702-9_18 · Cited by 266
Recommendation for key management: part 1 - general
Barker, E. (2020) · doi:10.6028/nist.sp.800-57pt1r5 · Cited by 271
Chaskey: An Efficient MAC Algorithm for 32-bit Microcontrollers
Mouha, N., Mennink, B., Herrewege, A. V., Watanabe, D., Bart Preneel, A., & Verbauwhede, I. M. R. (2014) · Lecture notes in computer science · doi:10.1007/978-3-319-13051-4_19 · Cited by 204
“This includes MAC algorithms such as UMAC [16], Poly1305- AES [11], and GMAC [34].”
MethodInfluentialThe Hummingbird-2 Lightweight Authenticated Encryption Algorithm
Engels, D. W., Saarinen, M.-J. O., Schweitzer, P. P., & Smith, E. M. (2012) · Lecture notes in computer science · doi:10.1007/978-3-642-25286-0_2 · Cited by 191
On Securing Underwater Acoustic Networks: A Survey
Jiang, S. (2018) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2018.2864127 · Cited by 174
“The tag can be verified without any decryption operations, and its length ranges from 0 to 128 bits, depending on the required security level, with 64∼128 bits being recommended [143].”
BackgroundMethodInfluentialAEGIS: A Fast Authenticated Encryption Algorithm
Wu, H., & Preneel, B. (2014) · Lecture notes in computer science · doi:10.1007/978-3-662-43414-7_10 · Cited by 154
Transitioning the use of cryptographic algorithms and key lengths
Barker, E. B., & Roginsky, A. L. (2019) · doi:10.6028/nist.sp.800-131ar2 · Cited by 194
A Security Framework for the Internet of Things in the Future Internet Architecture
Liu, X., Zhao, M., Li, S., Zhang, F., & Trappe, W. K. (2017) · Future Internet · doi:10.3390/fi9030027 · Cited by 135
“The prototype adopts AES Galois/Counter Mode (GCM) [57] as the authenticated encryption algorithm, which is a block cipher with both encryption and authentication functionalities.”
MethodReconsidering Generic Composition
Namprempre, C., Rogaway, P., & Shrimpton, T. (2014) · Lecture notes in computer science · doi:10.1007/978-3-642-55220-5_15 · Cited by 134
“Standardized AE methods—modes like CCM, GCM, and OCB [10, 11, 15]—are secure as nAE schemes.”
MethodWeinberg, Z., Wang, J., Yegneswaran, V., Briesemeister, L., Cheung, S., Wang, F., & Boneh, D. (2012) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2382196.2382211 · Cited by 122
“Pattern filters look for deterministic patterns in cleartext that may indicate undesirable material.”
BackgroundThe Multi-user Security of Authenticated Encryption: AES-GCM in TLS 1.3
Mihir Bellare, Y., & Tackmann, B. (2016) · Lecture notes in computer science · doi:10.1007/978-3-662-53018-4_10 · Cited by 108
“GCM was proposed by McGrew and Viega (MV) [24] and standardized by NIST as [12].”
MethodGlamdring: automatic application partitioning for intel SGX
Lind, J., Priebe, C., Muthukumaran, D., et al. (2017) · Spiral (Imperial College London) · Cited by 105
Chen, F., Wang, S., Jiang, X., Ding, S., Lu, Y., Kim, J., Şahinalp, S. C., Shimizu, C., Burns, J. C., Wright, V., et al. (2016) · Bioinformatics · doi:10.1093/bioinformatics/btw758 · Cited by 94
Costello, C., & Longa, P. (2015) · Lecture notes in computer science · doi:10.1007/978-3-662-48797-6_10 · Cited by 98
Breaking and Repairing GCM Security Proofs
Iwata, T., Ohashi, K., & Minematsu, K. (2012) · Lecture notes in computer science · doi:10.1007/978-3-642-32009-5_3 · Cited by 94
“There are cases where non-96-bit nonces are allowed, including NIST SP 800-38D [15], ISO/IEC 19772 [7], PKCS #11 [4], and most software libraries (e.g., Gladman’s code [17], CRYPTO++ [14], Java SE [2], and BouncyCastle [1]).”
BackgroundMethodToward the Development of Secure Underwater Acoustic Networks
Lal, C., Petroccia, R., Pelekanakis, K., Conti, M., & Alves, J. (2017) · IEEE Journal of Oceanic Engineering · doi:10.1109/joe.2017.2716599 · Cited by 90
Efficient and High-Performance Parallel Hardware Architectures for the AES-GCM
Kermani, M. M., & Reyhani-Masoleh, A. (2011) · IEEE Transactions on Computers · doi:10.1109/tc.2011.125 · Cited by 90
“Then, the GHASHH function calculates (1) [5].”
BackgroundMethodInfluentialImplementing and Proving the TLS 1.3 Record Layer
Delignat-Lavaud, A., Cédric Fournet, A., Kohlweiss, M., et al. (2017) · Proceedings - IEEE Symposium on Security and Privacy/Proceedings of the ... IEEE Symposium on Security and Privacy · doi:10.1109/sp.2017.58 · Cited by 88
“We treat the two main constructions, GHASH and Poly1305, using the same definitions, code, and proofs, inasmuch as possible.”
InfluentialStatus report on the final round of the NIST lightweight cryptography standardization process
Turan, M. S., McKay, K. A., Chang, D., Bassham, L. E., Kang, J., Waller, N. D., Kelsey, J. M., & Hong, D. (2022) · doi:10.6028/nist.ir.8454 · Cited by 118
Parallelizable Rate-1 Authenticated Encryption from Pseudorandom Functions
Minematsu, K. (2014) · Lecture notes in computer science · doi:10.1007/978-3-642-55220-5_16 · Cited by 86
“Calls On-line Parallel Primitive CCM [2] a + 2 m no no E GCM [3] m [E] and a + m [Mul] yes yes E, Mul † EAX [11] a + 2 m yes no E OCB [24,33,35] a example, where decryption is exceptionally slower than encryption on microcontrollers [32].”
BackgroundMethodRecommendation for password-based key derivation :
Turan, M. S., Barker, E. B., Burr, W. E., & Chen, L. (2010) · doi:10.6028/nist.sp.800-132 · Cited by 85
Singhvi, A., Akella, A., Gibson, D., et al. (2020) · doi:10.1145/3387514.3405897 · Cited by 70
Banerjee, U., Wright, A., Juvekar, C., Waller, M., Arvind, A., & Chandrakasan, A. P. (2019) · IEEE Journal of Solid-State Circuits · doi:10.1109/jssc.2019.2915203 · Cited by 69
“AES-GCM uses the AES forward cipher for both encryption and decryption, and a Galois multiplication-based special hash function called GHASH for authentication [9].”
MethodCycling Attacks on GCM, GHASH and Other Polynomial MACs and Hashes
Saarinen, M.-J. O. (2012) · Lecture notes in computer science · doi:10.1007/978-3-642-34047-5_13 · Cited by 67
“Due to the peculiar way finite field arithmetic is defined in the GCM standard [14], the identity element with ord(H) = 1 is:”
BackgroundMethodMulti-key Security: The Even-Mansour Construction Revisited
Mouha, N., & Luykx, A. (2015) · Lecture notes in computer science · doi:10.1007/978-3-662-47989-6_10 · Cited by 67
“In the case of MAC functions, NIST not only recommends to limit the number of message blocks under the same key, but also to limit the number of MAC failures before rekeying is required [27,28].”
BackgroundAuthentication of smart grid communications using quantum key distribution
Alshowkan, M., Evans, P. G., Starke, M. R., Earl, D., & Peters, N. A. (2022) · Scientific Reports · doi:10.1038/s41598-022-16090-w · Cited by 73
Shaon, F., Kantarcıoğlu, M., Lin, Z., et al. (2017) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3133956.3134095 · Cited by 65
Chen, Y., Sun, W., Zhang, N., et al. (2018) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2018.2885287 · Cited by 63
“In this experiment, we aim to measure the performance penalty when using Intel SGX. Specifically, we implemented a 128bit AES[GCM] scheme to demonstrate the additional cost by SGX through evaluating its performance.”
MethodInfluentialFPGA parallel-pipelined AES-GCM core for 100G Ethernet applications
Henzen, L., & Fichtner, W. (2010) · European Solid-State Circuits Conference (ESSCIRC) · doi:10.1109/esscirc.2010.5619894 · Cited by 62
“As pointed out in [15], the same counter should not be used twice with the same key.”
BackgroundComputing Small Discrete Logarithms Faster
Bernstein, D. J., & Lange, T. (2012) · Lecture notes in computer science · doi:10.1007/978-3-642-34931-7_19 · Cited by 62
Boosting Authenticated Encryption Robustness with Minimal Modifications
Ashur, T., Dunkelman, O., & Luykx, A. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-63697-9_1 · Cited by 61
Status report on the second round of the NIST lightweight cryptography standardization process
Turan, M. S., McKay, K. A., Chang, D., Çalık, Ç., Bassham, L. E., Kang, J., & Kelsey, J. M. (2021) · doi:10.6028/nist.ir.8369 · Cited by 72
“dards (especially AES-GCM [32] and SHA-2 [33]) were favored during the selection.”
BackgroundInfluentialMcKay, K. A., & Cooper, D. A. (2019) · doi:10.6028/nist.sp.800-52r2 · Cited by 66
Cyber Security for Smart Grid, Cryptography, and Privacy
Iyer, S. (2011) · International Journal of Digital Multimedia Broadcasting · doi:10.1155/2011/372020 · Cited by 56
Efficient Schemes for Committing Authenticated Encryption
Mihir Bellare, Y., & Hoang, V. T. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-07085-3_29 · Cited by 54
Jones, M. B. (2015) · doi:10.17487/rfc7518 · Cited by 55
Nonce-Disrespecting Adversaries:Practical Forgery Attacks on GCM in TLSPreprint
Böck, H., Zauner, A., Devlin, S., et al. (2017) · IACR Cryptology ePrint Archive · doi:10.5281/zenodo.3610301 · Cited by 50
Providing Integrity, Authenticity, and Confidentiality for Header and Pixel Data of DICOM Images
Al‐Haj, A. (2014) · Journal of Imaging Informatics in Medicine · doi:10.1007/s10278-014-9734-8 · Cited by 49
Improving Throughput of AES-GCM with Pipelined Karatsuba Multipliers on FPGAs
Zhou, G., Michalik, H., & Hinsenkamp, L. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-00641-8_20 · Cited by 48
A Security Framework for NoC Using Authenticated Encryption and Session Keys
Kapoor, H. K., Rao, G. B., Arshi, S., et al. (2013) · Circuits Systems and Signal Processing · doi:10.1007/s00034-013-9568-5 · Cited by 48
Cache-Attacks on the ARM TrustZone Implementations of AES-256 and AES-256-GCM via GPU-Based Analysis
Lapid, B., & Wool, A. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-10970-7_11 · Cited by 53
Bitstream Encryption and Authentication Using AES-GCM in Dynamically Reconfigurable Systems
Hori, Y., Satoh, A., Sakane, H., & Toda, K. (2008) · Lecture notes in computer science · doi:10.1007/978-3-540-89598-5_18 · Cited by 45
CLOC: Authenticated Encryption for Short Input
Iwata, T., Minematsu, K., Guo, J., et al. (2015) · Lecture notes in computer science · doi:10.1007/978-3-662-46706-0_8 · Cited by 45
“We also considered GCM for comparison, however, recent studies show that GCM does not perform well on constrained devices (see e.g. [10,38]), hence we decided not to include it.”
Authenticated Encryption Schemes: A Systematic Review
Jimale, M. A., Z’aba, M. R., Kiah, M. L. M., et al. (2022) · IEEE Access · doi:10.1109/access.2022.3147201 · Cited by 43
On Weak Keys and Forgery Attacks Against Polynomial-Based MAC Schemes
Procter, G., & Cid, C. (2014) · Lecture notes in computer science · doi:10.1007/978-3-662-43933-3_15 · Cited by 40
A verified, efficient embedding of a verifiable assembly language
Fromherz, A., Giannarakis, N., Hawblitzel, C., Parno, B. J., Rastogi, A., & Swamy, N. (2019) · Proceedings of the ACM on Programming Languages · doi:10.1145/3290376 · Cited by 45
“We then apply the resulting system to verify efficient implementations of two widely used cryptographic algorithms, Poly1305 [Bernstein 2005] and AES-GCM [NIST 2007], that provide secrecy and integrity for over 90% of secure Internet connections [Mozilla 2018].”
MethodA Secure Cross-Layer Protocol for Multi-hop Wireless Body Area Networks
Singelée, D., Latré, B., Braem, B., et al. (2008) · Lecture notes in computer science · doi:10.1007/978-3-540-85209-4_8 · Cited by 39
Blockcipher-Based Authenticated Encryption: How Small Can We Go?
Chakraborti, A., Iwata, T., Minematsu, K., & Nandi, M. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-66787-4_14 · Cited by 39
An Authentication and Secure Communication Scheme for In-Vehicle Networks Based on SOME/IP
Ma, B., Yang, S., Zuo, Z., et al. (2022) · Sensors · doi:10.3390/s22020647 · Cited by 35
eeDTLS: Energy-Efficient Datagram Transport Layer Security for the Internet of Things
Banerjee, U., Juvekar, C., Fuller, S. H., & Chandrakasan, A. P. (2017) · Globecom · doi:10.1109/glocom.2017.8255053 · Cited by 34
“According to [18], AES-GCM tags can be truncated to 32 bits, provided the same encryption key is not used for more than 2(15) packets, each up to 256 bytes in length.”
BackgroundSecurity and privacy aware data aggregation on cloud computing
Silva, L. V., Barbosa, P., Marinho, R., et al. (2018) · Journal of Internet Services and Applications · doi:10.1186/s13174-018-0078-3 · Cited by 34
An Authenticated Encryption Based Security Framework for NoC Architectures
Sajeesh, K., & Kapoor, H. K. (2011) · International Symposium on Electronic System Design · doi:10.1109/ised.2011.17 · Cited by 33
“Then we will explain the details of Galois Counter mode operation [13] (GCM), an AE scheme.”
MethodSignature Gateway: Offloading Signature Generation to IoT Gateway Accelerated by GPU
Chang, C., Lee, W., Liu, Y., Goi, B., & Phan, R. C. ‐. (2018) · IEEE Internet of Things Journal · doi:10.1109/jiot.2018.2881425 · Cited by 32
“, AES/GCM [13]) to generate ciphertext and authentication tag.”
BackgroundAES Galois Counter Mode for the Secure Shell Transport Layer Protocol
Igoe, K., & Solinas, J. A. (2009) · doi:10.17487/rfc5647 · Cited by 32
SecureSurgiNET: A framework for ensuring security in telesurgery
Iqbal, S., Farooq, S., Shahzad, K., Malik, A. W., Hamayun, M. M., & Hasan, O. (2019) · International Journal of Distributed Sensor Networks · doi:10.1177/1550147719873811 · Cited by 33
One Bad Apple: Backwards Compatibility Attacks on State-of-the-Art Cryptography
Jager, T., Paterson, K. G., & Somorovsky, J. (2013) · Cited by 29
Packed AES-GCM Algorithm Suitable for AES/PCLMULQDQ Instructions
Jankowski, K., & Laurent, P. (2010) · IEEE Transactions on Computers · doi:10.1109/tc.2010.147 · Cited by 29
“For detailed description of entire AES-GCM algorithm implementations, please refer to [1] and [2].”
BackgroundMethodNonces Are Noticed: AEAD Revisited
Mihir Bellare, Y., Ng, R., & Tackmann, B. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-26948-7_9 · Cited by 28
Reliable Architecture-Oblivious Error Detection Schemes for Secure Cryptographic GCM Structures
Kermani, M. M., & Azarderakhsh, R. (2018) · IEEE Transactions on Reliability · doi:10.1109/tr.2018.2882484 · Cited by 27
“S TANDARDIZED by the National Institute of Standards and Technology, the GCM [1] is used in conjunction with block ciphers, such as the Advanced Encryption Standard (AES), Camellia, SMS4, and CLEFIA, through a hash function over”
MethodHILA5: On Reliability, Reconciliation, and Error Correction for Ring-LWE Encryption
Saarinen, M.-J. O. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-72565-9_10 · Cited by 27
“However, for active security we suggest that K is used as keying material for an AEAD (Authenticated Encryption with Associated Data) [41] scheme such as AES256-GCM [22,24] or Keyak [12] in order to protect message integrity.”
MethodDesign of a CANFD to SOME/IP Gateway Considering Security for In-Vehicle Networks
Zuo, Z., Yang, S., Ma, B., et al. (2021) · Sensors · doi:10.3390/s21237917 · Cited by 26
TRUSTORE: Side-Channel Resistant Storage for SGX using Intel Hybrid CPU-FPGA
Oh, H., Ahmad, A. M., Park, S. H., et al. (2020) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3372297.3417265 · Cited by 26
Diehl, W., Abdulgadir, A., Farahmand, F., et al. (2018) · Cryptography · doi:10.3390/cryptography2030026 · Cited by 25
Quantum Key Distribution Applicability to Smart Grid Cybersecurity Systems
Grice, W. P., Olama, M. M., Lee, A., & Evans, P. G. (2025) · IEEE Access · doi:10.1109/access.2025.3533942 · Cited by 30
Beyond Modes: Building a Secure Record Protocol from a Cryptographic Sponge Permutation
Saarinen, M.-J. O. (2014) · Lecture notes in computer science · doi:10.1007/978-3-319-04852-9_14 · Cited by 24
A Modular IoT Hardware Platform for Distributed and Secured Extreme Edge Computing
Merino, P., Mujica, G., Señor, J., et al. (2020) · Electronics · doi:10.3390/electronics9030538 · Cited by 24
Aldaya, A. C., Sarmiento, A., & Sánchez-Solano, S. (2015) · Journal of Cryptographic Engineering · doi:10.1007/s13389-015-0103-4 · Cited by 24
Blockchain-Enabled IoT for Rural Healthcare: Hybrid-Channel Communication with Digital Twinning
Kerrison, S., Jusak, J., & Huang, T. (2023) · Electronics · doi:10.3390/electronics12092128 · Cited by 27
ICEPOLE: High-Speed, Hardware-Oriented Authenticated Encryption
Morawiecki, P., Gaj, K., Homsirikamol, E., Matusiewicz, K., Pieprzyk, J., Rogawski, M., Srebrny, M., & Wójcik, M. (2014) · Lecture notes in computer science · doi:10.1007/978-3-662-44709-3_22 · Cited by 23
Sarkar, P. (2014) · Cryptography and Communications · doi:10.1007/s12095-013-0097-7 · Cited by 23
The Design Space of Lightweight Cryptography
Mouha, N. (2015) · Cited by 23
On improving resistance to Denial of Service and key provisioning scalability of the DTLS handshake
Tiloca, M., Gehrmann, C., & Seitz, L. (2016) · International Journal of Information Security · doi:10.1007/s10207-016-0326-0 · Cited by 22
Huang, R., & Suh, G. E. (2010) · Proceedings - International Symposium on Computer Architecture/Proceedings · doi:10.1145/1815961.1816015 · Cited by 22
“To avoid the long latency of the hash functions (80 rounds), GMAC [7] has recently been proposed as one of NIST recommendations.”
BackgroundArmour, M., & Poettering, B. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-35199-1_2 · Cited by 22
“Concretely, assume the adversary is provided with the AES-GCM encryption c = c1c2 = Enc(k,m, d;n) for unknown k,m but chosen d, n.”
MethodInfluentialThe weakness of integrity protection for LTE
Wu, T., & Gong, G. (2013) · ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec) · doi:10.1145/2462096.2462110 · Cited by 21
Selective Opening Security from Simulatable Data Encapsulation
Heuer, F., & Poettering, B. (2016) · Lecture notes in computer science · doi:10.1007/978-3-662-53890-6_9 · Cited by 20
“Concretely we analyse the CTR and CBC modes of operation (SP 800-38A [13]), a CBC variant with ciphertext stealing (CTS) (Addendum to SP800-38A [16]), the CCM mode (SP 80038C [14]), and the GCM mode (SP 800-38D [15]).”
MethodGuidelines for Cryptographic Algorithm Agility and Selecting Mandatory-to-Implement Algorithms
Housley, R. (2015) · Request for Comments · doi:10.17487/rfc7696 · Cited by 21
Efficient key-dependent message authentication in reconfigurable hardware
Crenne, J., Cotret, P., Gogniat, G., et al. (2011) · International Conference on Field-Programmable Technology (FPT) · doi:10.1109/fpt.2011.6132722 · Cited by 20
“This approach has proven popular since it is not constrained by intellectual property rights and has been shown to be provably secure [3].”
BackgroundLightweight authenticated encryption for embedded on-chip systems
Hatzivasilis, G., Floros, G., Papaefstathiou, I., et al. (2016) · Information Security Journal A Global Perspective · doi:10.1080/19393555.2016.1209259 · Cited by 20
“CAESAR will select a portfolio of algorithms offering advantages over AES-GCM (the current AE standard (Dworkin, 2007)) in 2017.”
MethodUnified Hardware for High-Throughput AES-Based Authenticated Encryptions
Sawataishi, S., Ueno, R., & Homma, N. (2020) · IEEE Transactions on Circuits & Systems II Express Briefs · doi:10.1109/tcsii.2020.3013415 · Cited by 20
“Currently, AES-GCM [4] is one of the most widely used encryption methods and is the de facto standard AEAD.”
MethodŁukowiak, M., Radziszowski, S., Vallino, J. R., & Wood, C. A. (2014) · ACM Transactions on Computing Education · doi:10.1145/2538029 · Cited by 20
“The following list enumerates these modes and how they contribute to the security properties of block ciphers [14], [15], [16], [17], [18], [19].”
BackgroundRainbow Signature Scheme to Secure GOOSE Communications From Quantum Computer Attacks
Reshikeshan, S. S. M., Koh, M. B., & Illindala, M. S. (2021) · IEEE Transactions on Industry Applications · doi:10.1109/tia.2021.3093375 · Cited by 19
IPSecco: A lightweight and reconfigurable IPSec core
Driessen, B., Güneysu, T. E., Kavun, E. B., et al. (2012) · International Conference on ReConFigurable Computing and FPGAs (ReConFig) · doi:10.1109/reconfig.2012.6416757 · Cited by 19
SeGShare: Secure Group File Sharing in the Cloud using Enclaves
Fuhry, B., Hirschoff, L., Koesnadi, S., & Kerschbaum, F. (2020) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn48063.2020.00061 · Cited by 20
“With a random initialization vector per encryption, AES-128 in GCM mode [34] can be used as a PAE implementation.”
MethodConfigurable memory security in embedded systems
Crenne, J., Vaslin, R., Gogniat, G., et al. (2013) · ACM Transactions on Embedded Computing Systems · doi:10.1145/2442116.2442121 · Cited by 19
“The authentication of main memory security is now performed using AES-GCM, a block cipher mode of operation which has previously been proven to be secure [National Institute of Standards and Technology 2007].”
MethodInfluentialBarker, E. B., Dang, Q. H., Frankel, S. E., Scarfone, K. A., & Wouters, P. (2020) · doi:10.6028/nist.sp.800-77r1 · Cited by 33
The (in)security of proprietary cryptography
Verdult, R. (2015) · Radboud Repository (Radboud University) · Cited by 19
Götzfried, J., Müller, T., de Clercq, R., Maene, P., Freiling, F., & Verbauwhede, I. M. R. (2015) · Annual Computer Security Applications Conference · doi:10.1145/2818000.2856129 · Cited by 18
Better Circuits for Binary Polynomial Multiplication
Find, M. G., & Peralta, R. (2018) · IEEE Transactions on Computers · doi:10.1109/tc.2018.2874662 · Cited by 18
“Additionally finite field multiplication is used in the Galois Counter mode of operation [3].”
Misuse-Resistant Variants of the OMD Authenticated Encryption Mode
Reyhanitabar, R., Serge Vaudenay, B., & Vizár, D. (2014) · Lecture notes in computer science · doi:10.1007/978-3-319-12475-9_5 · Cited by 17
“In this line, one of the most commonly known schemes is the GCM algorithm, which was originally introduced in [18] and standardized by NIST [11] as a blockcipher mode of operation for AE.”
MethodContext Discovery and Commitment Attacks
Menda, S., Len, J., Grubbs, P., et al. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-30634-1_13 · Cited by 17
“For concreteness, we illustrate how to double a 128 -bit string with the GCM [21] polynomial 𝑓 (𝛼) = 1 + 𝛼 + 𝛼 2 + 𝛼 7 + 𝛼 128 , denoted 2 ⋅ 𝑥 , as (𝑥 ≫ 1) ⊕ Δ where Δ = 0 128 if 𝑥 127 = 0 and Δ = 111000010 120 .”
InfluentialESE: Efficient Security Enhancement Method for the Secure Aggregation Protocol in Federated Learning
Haibo, T., Maonan, L., & Ren, S. (2023) · Chinese Journal of Electronics · doi:10.23919/cje.2021.00.370 · Cited by 18
Selected Areas in Cryptography – SAC 2019
(2020) · Lecture notes in computer science · doi:10.1007/978-3-030-38471-5 · Cited by 17
INFUSE: Invisible plausibly-deniable file system for NAND flash
Chen, C., Chakraborti, A., & Sion, R. (2020) · Proceedings on Privacy Enhancing Technologies · doi:10.2478/popets-2020-0071 · Cited by 17
“Further, each hidden chunk is associated with a 96-bit IV (initial vector) [16] and an 128-bit authentication tag after encryption.”
BackgroundDesign and Implementation of a Key-Lifecycle Management System
Björkqvist, M., Cachin, C., Haas, R., et al. (2010) · Lecture notes in computer science · doi:10.1007/978-3-642-14577-3_14 · Cited by 17
“To enforce strict access control, only key wrapping schemes are allowed that also provide strong authenticity, such as authenticated symmetric-key encryption in CCM [19] or GCM [12] padding mode.”
GCM Security Bounds Reconsidered
Niwa, Y., Ohashi, K., Minematsu, K., et al. (2015) · Lecture notes in computer science · doi:10.1007/978-3-662-48116-5_19 · Cited by 17
eMotion: An SGX extension for migrating enclaves
Park, J., Park, S., Kang, B. B., et al. (2018) · Computers & Security · doi:10.1016/j.cose.2018.09.008 · Cited by 17
Secure post‐quantum group key exchange: Implementing a solution based on Kyber
Pablos, J. I. E., & Vasco, M. I. G. (2023) · IET Communications · doi:10.1049/cmu2.12561 · Cited by 17
Ashur, T., Eichlseder, M., Lauridsen, M. M., et al. (2018) · Lecture notes in computer science · doi:10.1007/978-3-030-03329-3_2 · Cited by 16
“One of the most prominent standardized AEAD designs is AES-GCM [13,8], which is widely deployed in protocols such as TLS (since v1.”
Method
Metadata
- Authors
- Dworkin, M. J.
- Published
- 2007
- OpenAlex
- W2727655671
- Semantic Scholar
- e140766a2342c14037d83524d339e500e812589f
- Cited by
- 463
- References
- 8
- Citations by year
- 2026: 80 · 2025: 31 · 2024: 25 · 2023: 27 · 2022: 19 · 2021: 28 · 2020: 27 · 2019: 33 · 2018: 24 · 2017: 24 · 2016: 18 · 2015: 29 · 2014: 27 · 2013: 13 · 2012: 15
- Type
- report
- Language
- en
- Open access
- gold
- doi.org
- Licence
- public-domain
- Funders
- Government of Canada
- National Institute of Standards and Technology
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Cryptographic Implementations and Security
- Physical Sciences › Mathematics › Discrete Mathematics and Combinatorics › Coding theory and cryptography
- Physical Sciences › Computer Science › Computer Networks and Communications › Cryptography and Data Security
- Keywords
- block cipher, modes of operation, cryptographic standards, block cipher modes of operation
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
A language model drew the claims from the paper on 2026-10-20, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).
A second model labelled each claim on 2026-10-20 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
