The DOI matches its Crossref record, with a small difference in title or year; 8 of the 8 references it cites were found in a registry or an index; none of the 11 sources its claims cite is checked for support yet.
Recommendation for block cipher modes of operation :
Open accessAbstract
Reports on Information Security TechnologyThe Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure.ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology.ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems.This Special Publication 800-series reports on ITL's research, guidance, and outreach efforts in computer security, and its collaborative activities with industry, government, and academic organizations.Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately.Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose.
Overview
AI snapshot
Written from the paper’s full text.
TL;DR
NIST Special Publication 800-38D specifies Galois/Counter Mode (GCM), an authenticated encryption mode constructed from an approved 128-bit block cipher such as AES, together with its authentication-only specialization GMAC. It defines the algorithms, the critical IV/key uniqueness requirement, and constraints on tag lengths and invocation counts.
Key findings
- GCM combines confidentiality via a variant of Counter mode with authenticity via GHASH, a universal hash over a binary Galois field; input limits are len(P) ≤ 2³⁹−256 bits, len(A) ≤ 2⁶⁴−1 bits, and 1 ≤ len(IV) ≤ 2⁶⁴−1 bits, with all lengths required to be multiples of 8.
- Supported tag lengths are 128, 120, 112, 104, or 96 bits in general; 64- and 32-bit tags are permitted only under Appendix C constraints. For 32-bit tags, a maximum combined ciphertext+AAD of 2⁵ bytes allows 2²² invocations, down to 2¹⁰ bytes allowing 2¹¹ invocations; for 64-bit tags, 2¹⁵ bytes allows 2³² invocations, down to 2²⁵ bytes allowing 2¹⁷ invocations.
- The IV uniqueness requirement states the probability that the authenticated encryption function is ever invoked with the same IV and key on two or more distinct input sets shall be no greater than 2⁻³²; a single repeated IV may expose the implementation to forgery attacks (Joux), and the document says this requirement is "almost as important as the secrecy of the key."
- Unless an implementation uses only 96-bit IVs from the deterministic construction, total invocations of authenticated encryption shall not exceed 2³² across all IV lengths and instances with a given key; a reasonable overall limit of 2⁶⁴ blocks of plaintext and AAD per key is suggested.
Methods
- This is a standards specification, not an empirical study: it defines Algorithms 1–5 (block multiplication over GF(2¹²⁸), GHASH, GCTR, GCM authenticated encryption, and GCM authenticated decryption), with inputs, outputs, steps, diagrams, and summaries.
- It specifies requirements for the underlying block cipher (approved, 128-bit block size, key ≥128 bits, fresh and secret), two IV construction frameworks (deterministic and RBG-based), key establishment, and conformance categories (GCM and GMAC).
- No data, sample, or statistical analysis is reported; the document is normative guidance with appendices summarizing security rationale and short-tag constraints.
Limitations
- Stated: authentication assurance is "strong, but not absolute" — a targeted ciphertext forgery is expected to succeed with probability approximately n/2ᵗ, where n is the total number of blocks in the GHASH encoding of ciphertext and AAD, so GCM is "not well-suited for use with short tag lengths or very long messages," and each successful forgery increases the probability of subsequent ones and leaks information about the hash subkey H.
- Stated: GCM does not inherently prevent replay of a valid authenticated-encryption output; the controlling protocol must monitor IV duplication or incorporate identifying information (e.g., sequence numbers, timestamps) into the AAD.
- Stated: the simplified GHASH in this Recommendation does not obtain all of the properties shown for the designers' definition of GHASH in Ref. [7]; also, security assurance degrades as more data is processed with a single key.
Model-written summary. Check it against the paper before relying on it.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
0 of 11 cited sources checked · 0 supported · 0 flagged
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In other words, the adversary essentially could control the plaintext output of the authenticated decryption function.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Independent of this attack, an adversary may attempt to systematically guess many different tags for a given input to authenticated decryption, and thereby increase the probability that one (or more) of them, eventually, will be accepted as valid.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“If the output is FAIL, then it is certain that at least one of the given inputs (i.e., the ciphertext, the AAD, the IV, or the tag) is not authentic.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Compliance with this requirement is crucial to the security of GCM.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 8 Uniqueness Requirement on IVs and Keys
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passes- Rests on an assumption: The underlying approved block cipher is secure.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Moreover, each successful forgery in this attack 1) increases the probability that subsequent targeted forgeries will succeed, and 2) leaks information about the hash subkey, H.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The adversary then could easily construct a ciphertext forgery.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesIn the paper
“For the RBG-based construction of IVs, the above requirement, in conjunction with the requirement that r(i)≥96, is sufficient to ensure the uniqueness requirement in Sec. 8, as follows from the discussion in Ref. [4].”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 8.3 Constraints on the Number of Invocations
What the sources say
- Not matchedcites [4]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passes- Not matched
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In other words, an adversary, i.e., a party without access to the key or to the authenticated encryption function, may be able to produce the correct tag for some triple of ciphertext, AAD, and IV.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In other words, GCM, like many other authentication mechanisms, does not inherently prevent an adversary from intercepting the output of an invocation of authenticated encryption and”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
Strength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In the above scenario, knowing the original plaintext that corresponds to the given ciphertext, the adversary can construct the substitute ciphertext in such a way as to correspond to any desired plaintext of the same length.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passes
- Probably not a substantial claim. 30
- It may state two separate claims as one. 7
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“GCM provides assurance of the confidentiality of data using a variation of the Counter mode of operation for encryption.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 3 Introduction
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesProbably not a substantial claim.
- Rests on an assumption: The underlying approved block cipher is secure.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The hash subkey, denoted H, is generated by applying the block cipher to the”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 5.3 Primitives for Confidentiality and Authentication
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesProbably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Compliance with these two requirements implies compliance with the uniqueness requirement on IVs in Sec. 8.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“GCM can also provide authentication assurance for additional data (of practically unlimited length per invocation) that is not encrypted.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 3 Introduction
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesProbably not a substantial claim.
- Rests on an assumption: The underlying approved block cipher is secure.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“As described in Appendix B, the successful verification of the tag within the authenticated decryption function gives assurance of the authenticity of the data; however, the party that presents the input data to the authenticated decryption function may not be the original source of the plaintext and AAD.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
Strength:plain· not yet calibratedCausal:conditional· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIt may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Each of these functions is relatively efficient and parallelizable; consequently, high-throughput implementations are possible in both hardware and software.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 3 Introduction
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesProbably not a substantial claim. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Consequently, GCM is not well-suited for use with short tag lengths or very long messages.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesIt may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“For some voice or video applications, short authentication tags can be appropriate.The forgery of some fraction of the individual authenticated”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
Strength:plain· not yet calibratedCausal:conditional· not yet calibratedTests✓ Asserted: passes✗ Checkable: fails✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. It may be too vague to check against evidence. The paper’s conclusions may not depend on it.
In the paper
“The mechanism for the confidentiality of the plaintext within GCM is a variation of the Counter mode [10], with a particular incrementing function, denoted inc 32 , for generating the necessary sequence of counter blocks.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 5.3 Primitives for Confidentiality and Authentication
What the sources say
- Not matchedcites [10]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
- Not matched
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The secure operation of a cryptographic algorithm depends not only on the proper implementation of the steps of the algorithm, but also on the adherence to the associated requirements.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In some protocols an adversary may even be able to use data that the verifier itself generated earlier in the protocol.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
Strength:hedged· not yet calibratedCausal:conditional· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In practice, the requirements in Sec.5.1 should ensure that a key is fresh when it is generated, if the generation mechanism is resistant to tampering.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 8.1 Key Establishment
Strength:hedged· not yet calibratedCausal:conditional· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✗ Based: failsProbably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The authentication mechanism within GCM is based on a hash function, called GHASHfoot_0 , that features multiplication by a fixed parameter, called the hash subkey, within a binary Galois field.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 5.3 Primitives for Confidentiality and Authentication
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesProbably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“GCM provides stronger authentication assurance than a (non-cryptographic) checksum or error detecting code; in particular, GCM can detect both 1) accidental modifications of the data and 2) intentional, unauthorized modifications.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 3 Introduction
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesProbably not a substantial claim. It may state two separate claims as one.
- Rests on an assumption: The underlying approved block cipher is secure.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“In effect, the GHASH function calculates X 1 •H m ⊕ X 2 •H m-1 ⊕ ... ⊕ X m-1 •H 2 ⊕ X m •H.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Output: block GHASH H (X).
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The GCM functions require only the forward direction of the underlying block cipher (i.e., the inverse direction is not required).”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 3 Introduction
Strength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✗ Based: failsProbably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The • operation on (pairs of) the 2 128 possible blocks corresponds to the multiplication operation for the binary Galois (finite) field of 2 128 elements.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Steps:
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesProbably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In practice, this requirement is almost as important as the secrecy of the key.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 8 Uniqueness Requirement on IVs and Keys
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesProbably not a substantial claim.
- Rests on an assumption: The underlying approved block cipher is secure.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The GCM functions are”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 3 Introduction
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“If some or all of the additional, non-confidential data is fixed, then the corresponding elements of the GCM authentication mechanism can be pre-computed.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 3 Introduction
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✗ Based: failsProbably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“GHASH is a keyed hash function but not, on its own, a cryptographic hash function.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 5.3 Primitives for Confidentiality and Authentication
Load-bearingStrength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesProbably not a substantial claim. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“For GCM, the requirement in Sec.5.2.1 for the uniqueness of the IVs is almost as important, although not as obvious.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesProbably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“If the output is the plaintext, then the design of the mode provides strong, but not absolute, assurance that the purported source of the data created the tag, i.e., that the plaintext and the AAD (and the IV and the tag) are authentic.Consequently, the mode also provides strong assurance that this information was not subsequently altered, either intentionally or unintentionally.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesIt may state two separate claims as one.
In the paper
“For example, GCM keys may be established using the key derivation functions of the following protocols as allowed in [9]: Transport Layer Security, Internet Key Exchange v1 and v2, and Secure Shell.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 8.1 Key Establishment
What the sources say
- Not matchedcites [9]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
Strength:hedged· not yet calibratedCausal:conditional· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
- Not matched
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The authenticity of the protected data can be verified independently from the recovery of the confidential data from its encrypted form.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 3 Introduction
Load-bearingStrength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✗ Based: failsProbably not a substantial claim. The paper may give no reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“GCM does not employ the inverse cipher function.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 5.1 Block Cipher
Strength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Eventually, H may be compromised entirely, with consequences as described at the end of Appendix A: the authentication assurance is completely lost.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesIt may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“As with any tag-based authentication mechanism, if the adversary chooses a t-bit tag at random, it is expected to be correct for given data with probability 1/2 t .”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
Load-bearingStrength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesProbably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“If the unique initialization string is predictable, and the length of the confidential data is known, then the block cipher invocations within the GCM encryption mechanism can be pre-computed.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 3 Introduction
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✗ Based: failsProbably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Moreover, as with most block cipher modes of operation, the security assurance of GCM degrades as more data is processed with a single key.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 10 Conformance
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesProbably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The creation of an authentication tag by the authenticated encryption function provides the mechanism whereby assurance of the authenticity of the plaintext and AAD (and IV) can be obtained upon the execution of the authenticated decryption function.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesProbably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“One potential advantage of the RBG-based construction is that the RBG may be designed to recover from a loss of power in a straightforward manner, i.e., without requiring action from the IT professional that maintains the system.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 9.1 Design Considerations
Strength:hedged· not yet calibratedCausal:conditional· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Compliance with the uniqueness requirement on IVs, and hence the security of GCM, ultimately depends on the IT professional who configures, deploys, and maintains the GCM modules within a particular system.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 9.2 Operational Considerations
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✗ Based: failsProbably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“For the deterministic construction, all of the deterministic elements that are necessary to construct the IV would have to be available when power is restored.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 9.1 Design Considerations
Strength:hedged· not yet calibratedCausal:conditional· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
The paper relies on this without support.
The underlying approved block cipher is secure.
“GCM is constructed from an approved symmetric key block cipher with a block size of 128 bits, such as the Advanced Encryption Standard (AES) algorithm that is specified in Federal Information Processing Standard (FIPS) Pub.197 [2].”
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“To eliminate the risk of nonce reuse, the framework employs a stochastic generation approach compliant with NIST SP 800-38D guidelines (Dworkin, 2007).”
From A high-throughput AES-GCM implementation on GPUs for secure, policy-based access to massive astronomical catalogs (2026) · cites this paper as Dworkin, 2007
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Archives approaching N ∼ 2 32 files per key fall into the regime where NIST SP 800-38D §8.3 recommends key rotation; our framework supports this through the explicit key reference required by every encryption operation.”
From A high-throughput AES-GCM implementation on GPUs for secure, policy-based access to massive astronomical catalogs (2026) · cites this paper as Dworkin, 2007
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Third, standardization: AES-GCM is specified by NIST SP 800-38D (Dworkin, 2007) as an approved AEAD mode, whereas CTR + HMAC, although built from approved primitives, is not itself a standardized AEAD construction.”
From A high-throughput AES-GCM implementation on GPUs for secure, policy-based access to massive astronomical catalogs (2026) · cites this paper as Dworkin, 2007
Experimental — accuracy not yet measuredThe cited source says what the claim attributes to it.
In the citing paper
“The framework implements the AES-128-GCM standard (Dworkin, 2007).”
From A high-throughput AES-GCM implementation on GPUs for secure, policy-based access to massive astronomical catalogs (2026) · cites this paper as Dworkin, 2007
The cited source says what the claim attributes to it.
In the citing paper
“The security of the AES-GCM mode relies strictly on the uniqueness of the initialization vector for a given key.”
From A high-throughput AES-GCM implementation on GPUs for secure, policy-based access to massive astronomical catalogs (2026) · cites this paper as Dworkin, 2007
Citations
Cites
THE ADVANCED ENCRYPTION STANDARD
Stallings, W. (2002) · Cryptologia · doi:10.1080/0161-110291890876 · Cited by 770
Recommendation for block cipher modes of operation: methods and techniques
Dworkin, M. J. (2001) · doi:10.6028/nist.sp.800-38a · Cited by 746
Self-citationThe Security and Performance of the Galois/Counter Mode (GCM) of Operation
McGrew, D. A., & Viega, J. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-30556-9_27 · Cited by 530 · cited 1×
“[7] gives a detailed treatment of the security properties of GCM.”
BackgroundSecurity Requirements for Cryptographic Modules
Daley, W. M., Shavers, C., & Kammer, R. G. (1999) · Defense Technical Information Center (DTIC) · Cited by 405
The Galois/Counter Mode of Operation (GCM)
McGrew, D. A., & Viega, J. (2005) · Cited by 332
Security Requirements for Cryptographic Modules
National Institute of Standards and Technology (US) (2019) · Federal Information Processing Standards Publication (FIPS PUB) 140-3 · doi:10.6028/nist.fips.140-3 · Cited by 118
The Advanced Encryption Standard (AES)
Paar, C., & Pelzl, J. (2009) · Springer eBooks · doi:10.1007/978-3-642-04101-3_4 · Cited by 80
Flagged first, then by citations
Research works printed but not linked: 1
- IEEE P1619.1™/D23, Draft Standard for Authenticated Encryption with Length Expansion for Storage Devices.
Cited by
Sorted by citations
Items 101–200 of 464
On the Adaptive Security of MACs and PRFs
Morgan, A., Pass, R., & Shi, E. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-64837-4_24 · Cited by 16
Comb to Pipeline: Fast Software Encryption Revisited
Bogdanov, A., Lauridsen, M. M., & Tischhauser, E. (2015) · Lecture notes in computer science · doi:10.1007/978-3-662-48116-5_8 · Cited by 16
“Indeed, NIST-standardized CBC, CFB, OFB and CMAC [10] as well as CLOC and POET from FSE 2014 and McOE-G from FSE 2012 are essentially sequential, which limits their performance on state-of-the-art servers and desktops significantly, as the pipeline cannot be filled entirely, having a severe performance penalty as a co…”
MethodInfluentialA data hiding approach for sensitive smartphone data
Luo, C., Fylakis, A., Partala, J., Klakegg, S., Gonçalves, J., Liang, K., Seppänen, T., & Kostakos, V. (2016) · ACM International Joint Conference on Pervasive and Ubiquitous Computing (UbiComp) · doi:10.1145/2971648.2971686 · Cited by 15
EncDBDB: Searchable Encrypted, Fast, Compressed, In-Memory Database Using Enclaves
Fuhry, B., A, J. J. H., & Kerschbaum, F. (2021) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn48987.2021.00054 · Cited by 20
“AES-128 in GCM mode [29] can be used as a PAE implementation.”
MethodByte Frequency Based Indicators for Crypto-Ransomware Detection from Empirical Analysis
Kim, G. Y., Paik, J., Kim, Y.-C., et al. (2022) · Journal of Computer Science and Technology · doi:10.1007/s11390-021-0263-x · Cited by 15
Singh, B. M., & Jaisankar, N. (2023) · Journal of King Saud University - Computer and Information Sciences · doi:10.1016/j.jksuci.2023.101629 · Cited by 15
“The key used in GCM-AES is generated using a new key derivation method.”
InfluentialTwisted Polynomials and Forgery Attacks on GCM
Abdelraheem, M. A., Beelen, P., Bogdanov, A., et al. (2015) · Lecture notes in computer science · doi:10.1007/978-3-662-46800-5_29 · Cited by 15
“After finding N , we can query the same GCM oracle (that has been queried for encrypting M with the nonce N where |N | = 96) with a new nonce N that has a different size |N | ≥ 128 2 for the encryption of some plaintext M = M 1 || · · · ||M l .”
BackgroundMethodInfluentialSecuring Underwater Communications
Capossele, A., Chiara Petrioli, B., Saturni, G., et al. (2017) · ACM International Conference on Underwater Networks & Systems (WUWNet) · doi:10.1145/3148675.3152760 · Cited by 15
“We decided to truncate the tag of the MAC to 16 bytes without affecting the security [9].”
MethodStallings, W. (2010) · Cryptologia · doi:10.1080/01611191003598295 · Cited by 15
Oláh, N., Molnár, B., & Huszti, A. (2023) · Symmetry · doi:10.3390/sym15101886 · Cited by 14
On modes of operations of a block cipher for authentication and authenticated encryption
Chakraborty, D., & Sarkar, P. (2015) · Cryptography and Communications · doi:10.1007/s12095-015-0153-6 · Cited by 14
200 Gbps Hardware Accelerated Encryption System for FPGA Network Cards
Martinásek, Z., Hajný, J., Smékal, D., et al. (2018) · doi:10.1145/3266444.3266446 · Cited by 14
Elastic-Tweak: A Framework for Short Tweak Tweakable Block Cipher
Chakraborti, A., Datta, N., Jha, A., Mancillas-López, C., Nandi, M., & Sasaki, Y. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-92518-5_6 · Cited by 14
The Design and Evolution of OCB
Krovetz, T., & Rogaway, P. (2021) · Journal of Cryptology · doi:10.1007/s00145-021-09399-8 · Cited by 14
“A low-level choice where OCB and GCM [10] part ways is in the representation of field elements.”
BackgroundResultInfluentialPlinius: Secure and Persistent Machine Learning Model Training
Yuhala, P., Felber, P. A., Schiavoni, V., & Tchana, A. (2021) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn48987.2021.00022 · Cited by 15
“In-enclave symmetric encryption/decryption relies on AES Galois counter mode (GCM) [13] implementation from the Intel SGX SDK. AES-GCM uses a 128, 192 or 256 bit key for all cryptographic operations, and provides assurance of the integrity of the confidential data [13].”
MethodOn Weak Keys and Forgery Attacks Against Polynomial-Based MAC Schemes
Procter, G., & Cid, C. (2014) · Journal of Cryptology · doi:10.1007/s00145-014-9178-9 · Cited by 13
Revisiting MAC Forgeries, Weak Keys and Provable Security of Galois/Counter Mode of Operation
Zhu, B., Tan, Y., & Gong, G. (2013) · Lecture notes in computer science · doi:10.1007/978-3-319-02937-5_2 · Cited by 13
The Advanced Encryption Standard: 20 Years Later
Menezes, A., & Stebila, D. (2021) · IEEE Security & Privacy · doi:10.1109/msec.2021.3107078 · Cited by 13
Ring-LWE Ciphertext Compression and Error Correction
Saarinen, M.-J. O. (2017) · doi:10.1145/3055245.3055254 · Cited by 13
“These constants were chosen to not overlap with CTR or AES-GCM constants [14] in case Kab is used to protect further communication from Bob, such as his authentication.”
MethodWong, M. M., Haj-Yahya, J., & Chattopadhyay, A. (2018) · doi:10.1145/3214292.3214298 · Cited by 13
“On the other hand, the overheads and latencies issues highlighted in the Section 4.1 can be best avoided by using the Galois Counter Mode (GCM) [12, 22] for memory authentication.”
MethodInfluentialSGCM: The Sophie Germain Counter Mode.
Saarinen, M.-J. O. (2011) · Cited by 13
Nonce-Misuse Security of the SAEF Authenticated Encryption Mode
Andreeva, E., Bhati, A. S., & Vizár, D. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-81652-0_20 · Cited by 13
“In 2016 B¨ock et al. [8] investigated the nonce misuse security of the AES-GCM [10] AE mode and managed to completely break the authenticity of those connections where servers repeated the nonce.”
BackgroundKermani, M. M. (2011) · Scholarship@Western (Western University) · Cited by 13
McGrew, D. A. (2012) · IACR Cryptology ePrint Archive · Cited by 14
Succinctly-Committing Authenticated Encryption
Mihir Bellare, Y., & Hoang, V. T. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-68385-5_10 · Cited by 12
Practical Cryptographic Data Integrity Protection with Full Disk Encryption
Brož, M., Patočka, M., & Matyáš, V. (2018) · IFIP advances in information and communication technology · doi:10.1007/978-3-319-99828-2_6 · Cited by 12
Trick or Tweak: On the (In)security of OTR’s Tweaks
Bost, R., & Sanders, O. (2016) · Lecture notes in computer science · doi:10.1007/978-3-662-53887-6_12 · Cited by 12
Practice-Oriented Provable Security and the Social Construction of Cryptography
Rogaway, P. (2016) · IEEE Security & Privacy · doi:10.1109/msp.2016.122 · Cited by 12
Bittl, S. (2014) · Lecture notes in computer science · doi:10.1007/978-3-319-06644-8_11 · Cited by 12
Gennaro, R., & Halevi, S. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-05445-7_4 · Cited by 12
“For example, one system that we encountered was using the GCM encryption mode, and needed to comply with the following requirement from the NIST standard for GCM [9]:”
MethodInfluentialAmazon Biobank: Assessing the Implementation of a Blockchain-Based Genomic Database
Kimura, L. T., Shiraishi, F. K., Andrade, E. R., Carvalho, T. C. M. D. B., & Junior, M. A. S. (2024) · IEEE Access · doi:10.1109/access.2024.3354716 · Cited by 12
“Another auxiliary operation is the encryption of new genetic data, which is done with the AES-GCM operation mode [58], and then create the resulting torrent file together with the corresponding magnet link.”
MethodMethods and Challenges of Cryptography-Based Privacy-Protection Algorithms for Vehicular Networks
Li, Y., Bi, R., Jiang, N., Li, F., Wang, M., & Jing, X. (2024) · Electronics · doi:10.3390/electronics13122372 · Cited by 13
Mobilon, E., & Arantes, D. S. (2021) · Microelectronics Journal · doi:10.1016/j.mejo.2021.105229 · Cited by 12
The PASSERINE Public Key Encryption and Authentication Mechanism
Saarinen, M.-J. O. (2012) · Lecture notes in computer science · doi:10.1007/978-3-642-27937-9_20 · Cited by 11
KRB-CCN: Lightweight Authentication and Access Control for Private Content-Centric Networks
Nunes, I. O., & Tsudik, G. (2018) · Lecture notes in computer science · doi:10.1007/978-3-319-93387-0_31 · Cited by 11
Fast Pseudorandomness for Independence and Load Balancing
Meka, R., Reingold, O., Rothblum, G. N., & Rothblum, R. D. (2014) · Lecture notes in computer science · doi:10.1007/978-3-662-43948-7_71 · Cited by 11
Security and Independence of Process Safety and Control Systems in the Petroleum Industry
Onshus, T., Bodsberg, L., Hauge, S., Jaatun, M. G., Lundteigen, M. A., Myklebust, T., Ottermo, M. V., Petersen, S., & Wille, E. (2022) · Journal of Cybersecurity and Privacy · doi:10.3390/jcp2010003 · Cited by 10
“In recent years, however, the IT industry has had to accept that such guarantees can only be given if one of the more closely defined protocols for authenticated encryption is used, such as AES-GCM [29] or AES-CCM [30].”
BackgroundIsobe, T., Ito, R., & Minematsu, K. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-88428-4_7 · Cited by 10
“Encryption in Alg. end if 16: end procedure 800-38D [8].”
BackgroundBitstream Protection in Dynamic Partial Reconfiguration Systems Using Authenticated Encryption
Hori, Y., Katashita, T., Sakane, H., Kenji, T. O. D. A., & Satoh, A. (2013) · IEICE Transactions on Information and Systems · doi:10.1587/transinf.e96.d.2333 · Cited by 10
Secured Image Transmission in Medical Imaging Applications—A Survey
Prabhu, P. P., & Manjunath, K. N. (2019) · Lecture notes in computational vision and biomechanics · doi:10.1007/978-3-030-04061-1_12 · Cited by 10
Validating and Securing DLMS/COSEM Implementations with the ValiDLMS Framework
Mendes, H. C., Medeiros, I., & Neves, N. (2018) · IEEE/IFIP International Conference on Dependable Systems and Networks Workshops (DSN-W) · doi:10.1109/dsn-w.2018.00060 · Cited by 10
Algorithm substitution attacks against receivers
Armour, M., & Poettering, B. (2022) · International Journal of Information Security · doi:10.1007/s10207-022-00596-5 · Cited by 9
“We exemplify this on the basis of two of the currently best-performing AES-based AEAD schemes: GCM [36] and OCB3 [48].”
MethodThe Committing Security of MACs with Applications to Generic Composition
Bhaumik, R., Chakraborty, B., Choi, W., et al. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-68385-5_14 · Cited by 9
“Standards that loosely follow these paradigms are GCM [Dwo07a], ChaCha20-Poly1305 [NL18] and EAX [BRW04] that loosely follow Encrypt-then-MAC, CCM [Dwo07b] that loosely follows MAC-then-Encrypt, and OCB [KR14] that loosely follows Encrypt-and-MAC.”
BackgroundBatteryless, Wireless, and Secure SoC for Implantable Strain Sensing
Abdelhamid, M. R., Ha, U., Banerjee, U., et al. (2022) · IEEE Open Journal of the Solid-State Circuits Society · doi:10.1109/ojsscs.2022.3230000 · Cited by 9
High-performance optimization of SM4-GCM based on FPGA
Lv, S. S., Li, B., Chen, X., et al. (2022) · doi:10.1109/ieeeconf52377.2022.10013330 · Cited by 9
“Consequently, people have proposed different encryption methods to encrypt the data transmitted in the network; among them, the AES-GCM algorithm combines AES and Galois/Counter Mode (GCM) [4] , which is an algorithm mode that can ensure data security and information integrity.”
MethodSecurity analysis of GCM for communication
Yap, W., Yeo, S. L., Heng, S., & Henricksen, M. (2013) · Security and Communication Networks · doi:10.1002/sec.798 · Cited by 9
Simple AEAD Hardware Interface (SÆHI) in a SoC
Saarinen, M.-J. O. (2014) · Workshop on Trustworthy Embedded Devices · doi:10.1145/2666141.2666144 · Cited by 9
Haq, I. U., Wang, J., & Zhu, Y. (2018) · IEEE Transactions on Consumer Electronics · doi:10.1109/tce.2018.2883778 · Cited by 9
A Modified Argon2i Using a Tweaked Variant of Blake3
Ciocan, I. T., Kelesidis, E.-A., Maimuţ, D., et al. (2021) · IEEE Asia-Pacific Conference on Communications (APCC) · doi:10.1109/apcc49754.2021.9609933 · Cited by 9
ESAR: Enhanced Secure Authentication and Revocation Scheme for Vehicular Ad Hoc Networks
Coruh, U., & Bayat, O. (2021) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2021.103081 · Cited by 9
GPU-Assisted AES Encryption Using GCM
Schönberger, G., & Fuß, J. (2011) · Lecture notes in computer science · doi:10.1007/978-3-642-24712-5_16 · Cited by 9
“GCM is defined in the NIST Special Publication 800-38D [2] and used as the default cipher mode in the IEEE Standard 802.”
A secure geographical routing protocol for highly-dynamic aeronautical networks
Swidan, A., Khattab, S. M., Abouelseoud, Y., et al. (2015) · IEEE Military Communications Conference (MILCOM) · doi:10.1109/milcom.2015.7357527 · Cited by 9
Mirigaldi, M., Piscopo, V., Martina, M., et al. (2025) · Chips · doi:10.3390/chips4020015 · Cited by 8
“Cryptography standards such as AES-GCM (AES with Galois/Counter Mode) [1],[2] and SHA-2 (Secure Hash Algorithm 2) [3] can be impractical in these constrained environments due to their computational and memory demands.”
Oblivious TLS via Multi-party Computation
Abram, D., Damgård, I., Schöll, P., et al. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-75539-3_3 · Cited by 8
Huang, R., & Suh, G. E. (2010) · ACM SIGARCH Computer Architecture News · doi:10.1145/1816038.1816015 · Cited by 8
Towards completion of the CCSDS space data link security protocol
Sanchez, I., Moury, G. A., Biggerstaff, C., et al. (2012) · Proceedings - IEEE Aerospace Conference · doi:10.1109/aero.2012.6187154 · Cited by 8
How to break XML encryption – automatically
Kupser, D., Mainka, C., Schwenk, J., & Somorovsky, J. (2015) · Cited by 8
Anonymous Communication in the Browser via Onion-Routing
Burgstaller, F., Derler, A., Kern, S., et al. (2015) · International Conference on P2P, Parallel, Grid, Cloud and Internet Computing (3PGCIC) · doi:10.1109/3pgcic.2015.22 · Cited by 8
“8AES-GCM[6] is used for symmetric encryption”
Modeling Memory Faults in Signature and Authenticated Encryption Schemes
Fischlin, M., & Günther, F. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-40186-3_4 · Cited by 8
Recommendation for Key ManagementPreprint
Barker, E. B. (2019) · doi:10.6028/nist.sp.800-57pt1r5-draft · Cited by 8
Mihir Bellare, Y., & Shea, L. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-30872-7_23 · Cited by 7
Novel Hardware Implementation of the Cipher Message Authentication Code
Michail, H. E., Selimis, G., Galanis, M., Schinianakis, D., & Goutis, C. E. (2008) · Journal of Computer Networks and Communications · doi:10.1155/2008/923079 · Cited by 7
A Hardware in the Loop Benchmark Suite to Evaluate NIST LWC Ciphers on Microcontrollers
Renner, S., Pozzobon, E., & Mottok, J. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-61078-4_28 · Cited by 7
Reconsidering Generic Composition: The Tag-then-Encrypt Case
Berti, F., Pereira, O., & Peters, T. (2018) · Lecture notes in computer science · doi:10.1007/978-3-030-05378-9_4 · Cited by 8
“Examples of the first path are AES-GCM [12], AESCCM [21], CHACHA20 POLY305 [26] (used in TLS 1.3 [14]), SCT [30] and the CAESAR candidates [8].”
MethodInfluentialHigh-Throughput Optimizations of AES Algorithm for Satellites
Pirzada, S. J. H., Hasan, M. N., Memon, Z. W., Haris, M., Xu, T., & Jianwei, L. (2020) · International Symposium on Recent Advances in Electrical Engineering (RAEE) · doi:10.1109/raeecs50817.2020.9265688 · Cited by 8
“Some researchers have implemented the parallel execution of the CMAC algorithm for optimization of throughput [7] [10].”
MethodSecurity Aspects of Smart Meter Infrastructures
Rigoev, I., & Sikora, A. (2023) · Lecture notes in energy · doi:10.1007/978-3-031-27556-2_5 · Cited by 7
P4EAD: Securing the In-band Control Channels on Commodity Programmable Switches
Bhatnagar, A., Khooi, X. Z., Song, C. H., et al. (2023) · doi:10.1145/3630047.3630242 · Cited by 7
High-Speed Architecture Design and Implementation for SMS4-GCM
Zhao, M., Shou, G., Hu, Y., et al. (2011) · doi:10.1109/cmc.2011.66 · Cited by 7
INT-RUP Security of Checksum-Based Authenticated Encryption
Zhang, P., Wang, P., Hu, H., et al. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-68637-0_9 · Cited by 7
High-Level Cryptographic Abstractions
Kane, C., Lin, B., Chand, S., Stoller, S. D., & Liu, Y. A. (2019) · doi:10.1145/3338504.3357343 · Cited by 8
New Security Improvements in Next-Generation Passive Optical Networks Stage 2 †
Člupek, V., Horváth, T., Münster, P., et al. (2019) · Applied Sciences · doi:10.3390/app9204430 · Cited by 7
Dissecting Performance Overheads of Confidential Computing on GPU-based Systems
Yang, Y., Sonji, M., & Jog, A. (2025) · IEEE International Symposium on Performance Analysis of Systems and Software (ISPASS) · doi:10.1109/ispass64960.2025.00020 · Cited by 7
“GHASH, which could be used to construct GMAC [44], achieves higher throughput (up to 8.9 GB/s) at the cost of confidentiality.”
InfluentialUstun, T. S., Farooq, S. M., & Hussain, S. M. S. (2021) · International Journal of Electrical Power & Energy Systems · doi:10.1016/j.ijepes.2021.107189 · Cited by 6
Evaluation of a Modular Approach to AES Hardware Architecture and Optimization
Swann, R., & Stine, J. E. (2023) · Journal of Signal Processing Systems · doi:10.1007/s11265-022-01832-w · Cited by 6
“AES encryption can be further expanded using Block Modes of Operation which provide additional symmetric features and abilities to expand the AES cipher [16].”
MethodE-MACs: Toward More Secure and More Efficient Constructions of Secure Channels
Alomair, B., & Poovendran, R. (2012) · IEEE Transactions on Computers · doi:10.1109/tc.2012.176 · Cited by 6
“(The CWC was later standardized by NIST in its Galois/Counter Mode (GCM) of authenticated encryption [41]).”
MethodAuthenticated Encryption: How Reordering Can Impact Performance
Alomair, B. (2012) · Lecture notes in computer science · doi:10.1007/978-3-642-31284-7_6 · Cited by 6
“National Institute of Standards and Technology (NIST) has adopted the CWC mode of operation in the standardized Galois/Counter Mode (GCM) of authenticated encryption [17].”
MethodAuthenticated Encryption with Small Stretch (or, How to Accelerate AERO)
Minematsu, K. (2016) · Lecture notes in computer science · doi:10.1007/978-3-319-40367-0_22 · Cited by 6
“We finally remark that [9] suggests to use AERO for reducing the overhead of Internet protocols : for IPsec, using a standard such as ESP AES-GCM would cause more than 24-byte expansion, while AERO can reduce it to 12-byte.”
MethodResultInfluentialNamespace Tunnels in Content-Centric Networks
Nunes, I. O., Tsudik, G., & Wood, C. A. (2017) · Conference on Local Computer Networks · doi:10.1109/lcn.2017.105 · Cited by 6
“AES256-GCM [25] is used to encrypt and authenticate content packets (Alg.”
MethodParallel Implementation of AES-GCM with High Throughput and Energy Efficiency
Su, J., Gu, N., Bai, Q., et al. (2018) · International Conference on Networking and Network Applications (NaNA) · doi:10.1109/nana.2018.8648719 · Cited by 6
“AES-GCM is defined in FIPS 800-38D by NIST [3].”
BackgroundChen, M., & Zadok, E. (2019) · ACM International Conference on Systems and Storage · doi:10.1145/3319647.3325830 · Cited by 6
“During encryption, Kurma uses the concatenation of the block offset and version as the initialization vector (IV); this avoids the security flaws of reusing IVs [18].”
An implementation method for SM4-GCM on FPGA
Li, L., Yang, F., Pan, Y., et al. (2017) · IEEE Advanced Information Technology, Electronic and Automation Control Conference (IAEAC) · doi:10.1109/iaeac.2017.8054348 · Cited by 6
Lightweight implementation of SILC, CLOC, AES-JAMBU and COLM authenticated ciphers
Jahanbani, M., Bagheri, N., & Norozi, Z. (2019) · Microprocessors and Microsystems · doi:10.1016/j.micpro.2019.102925 · Cited by 6
High Performance GHASH Function for Long Messages
Méloni, N., Négre, C., & Hasan, M. A. (2010) · Lecture notes in computer science · doi:10.1007/978-3-642-13708-2_10 · Cited by 6
A low power AES-GCM authenticated encryption core in 65nm SOTB CMOS process
Hoang, V., Nguyen, V.-T., Nguyen, A.-T., & Pham, C. (2017) · IEEE International Midwest Symposium on Circuits and Systems (MWSCAS) · doi:10.1109/mwscas.2017.8052873 · Cited by 6
“The authentication of the AES-GCM is performed by the Galois/Counter Mode (GCM) which utilizes a universal HASH function [4] to provide both data encryption and authentication, called authenticated encryption (AE).”
MethodHigh performance AES-GCM implementation based on efficient AES and FR-KOA multiplier
Zhang, Y., Wu, N., Zhou, F., et al. (2018) · IEICE Electronics Express · doi:10.1587/elex.15.20180559 · Cited by 6
“In 2007, National Institute of Standards and Technology (NIST) o ffi cially announced AES-GCM [1] as a working mode for AES [2].”
BackgroundBioID: A Privacy-Friendly Identity Document
Balli, F., Durak, F. B., & Serge Vaudenay, B. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-31511-5_4 · Cited by 6
Lighter, Faster, and Constant-Time: WhirlBob, the Whirlpool variant of StriBob.Preprint
Saarinen, M.-J. O., & Brumley, B. B. (2014) · IACR Cryptology ePrint Archive · Cited by 6
Key Management Systems at the Cloud Scale
Campagna, M., & Gueron, S. (2019) · Cryptography · doi:10.3390/cryptography3030023 · Cited by 5
“In this paper, we refer to the well known AES-GCM scheme as defined in [15].”
BackgroundMethodInfluentialWeissbaum, F., & Lugrin, T. (2023) · Springer eBooks · doi:10.1007/978-3-031-33386-6_2 · Cited by 5
Bit‐Sliced Implementation of SM4 and New Performance Records
Miao, X., Li, L., Guo, C. F., Wang, M., & Wang, W. (2023) · IET Information Security · doi:10.1049/2023/1821499 · Cited by 5
Message Authentication Codes (MACs)
Paar, C., & Pelzl, J. (2009) · Springer eBooks · doi:10.1007/978-3-642-04101-3_12 · Cited by 5
Maximizing Ethernet Security by Switch-Based Single Secure Domain
Wahid, K. F. (2010) · International Conference on Information Technology: New Generations · doi:10.1109/itng.2010.143 · Cited by 5
Ferguson, N., Schneier, B., & Kohno, T. (2015) · Wiley eBooks · doi:10.1002/9781118722367.ch4 · Cited by 6
A PUF-based provably secure message authentication algorithm and application
张, 效., & 谷, 大. (2021) · Scientia Sinica Informationis · doi:10.1360/ssi-2021-0261 · Cited by 4
Quantum security analysis of Rocca
Anand, R., & Isobe, T. (2023) · Quantum Information Processing · doi:10.1007/s11128-023-03908-3 · Cited by 5
“The forgery attacks on Rocca, and other similar ciphers with authenticated encryption such as, Aegis [43], Tiaoxin [38], AESGCM [11], SNOW-V [12] and ZUC-256 [48], generally leads to state/key recovery attacks.”
BackgroundMasked Iterate-Fork-Iterate: A New Design Paradigm for Tweakable Expanding Pseudorandom Function
Andreeva, E., Cogliati, B., Lallemand, V., et al. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-54773-7_17 · Cited by 4
“Some of the most popular nonce-based AE examples are OCB [RBBK01] and the NIST-recommended [NIS07] modes GCM [MV04] and CCM [Hou05].”
BackgroundHigh performance GHASH and impacts of a class of unconventional bases
Méloni, N., Négre, C., & Hasan, M. A. (2011) · Journal of Cryptographic Engineering · doi:10.1007/s13389-011-0013-z · Cited by 4
Secure Cryptographic Precomputation with Insecure Memory
Tsang, P. P., & Smith, S. W. (2008) · Springer eBooks · doi:10.1007/978-3-540-79104-1_11 · Cited by 4
“We refer the readers to [19,11] for details regarding the specification, performance and security of AES-GCM.”
MethodWHIRLBOB, the Whirlpool Based Variant of STRIBOB
Saarinen, M.-J. O., & Brumley, B. B. (2015) · Lecture notes in computer science · doi:10.1007/978-3-319-26502-5_8 · Cited by 4
hacspec: Towards Verifiable Crypto Standards
Bhargavan, K., Kiefer, F., & Strub, P.-Y. (2018) · Lecture notes in computer science · doi:10.1007/978-3-030-04762-7_1 · Cited by 4
“For example, the GCM [13] and ECDSA [16] spec-ifications both require unique nonces but the use of bad randomness and incorrect configuration has led to real-world implementations that repeat nonces, leading to practical attacks [9,12].”
Background
Metadata
- Authors
- Dworkin, M. J.
- Published
- 2007
- OpenAlex
- W2727655671
- Semantic Scholar
- e140766a2342c14037d83524d339e500e812589f
- Cited by
- 463
- References
- 8
- Citations by year
- 2026: 80 · 2025: 31 · 2024: 25 · 2023: 27 · 2022: 19 · 2021: 28 · 2020: 27 · 2019: 33 · 2018: 24 · 2017: 24 · 2016: 18 · 2015: 29 · 2014: 27 · 2013: 13 · 2012: 15
- Type
- report
- Language
- en
- Open access
- gold
- doi.org
- Licence
- public-domain
- Funders
- Government of Canada
- National Institute of Standards and Technology
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Cryptographic Implementations and Security
- Physical Sciences › Mathematics › Discrete Mathematics and Combinatorics › Coding theory and cryptography
- Physical Sciences › Computer Science › Computer Networks and Communications › Cryptography and Data Security
- Keywords
- block cipher, modes of operation, cryptographic standards, block cipher modes of operation
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
A language model drew the claims from the paper on 2026-10-20, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).
A second model labelled each claim on 2026-10-20 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
