The DOI matches its Crossref record, with a small difference in title or year; 8 of the 8 references it cites were found in a registry or an index; none of the 11 sources its claims cite is checked for support yet.
Recommendation for block cipher modes of operation :
Open accessAbstract
Reports on Information Security TechnologyThe Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure.ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology.ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems.This Special Publication 800-series reports on ITL's research, guidance, and outreach efforts in computer security, and its collaborative activities with industry, government, and academic organizations.Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately.Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose.
Overview
AI snapshot
Written from the paper’s full text.
TL;DR
NIST Special Publication 800-38D specifies Galois/Counter Mode (GCM), an authenticated encryption mode constructed from an approved 128-bit block cipher such as AES, together with its authentication-only specialization GMAC. It defines the algorithms, the critical IV/key uniqueness requirement, and constraints on tag lengths and invocation counts.
Key findings
- GCM combines confidentiality via a variant of Counter mode with authenticity via GHASH, a universal hash over a binary Galois field; input limits are len(P) ≤ 2³⁹−256 bits, len(A) ≤ 2⁶⁴−1 bits, and 1 ≤ len(IV) ≤ 2⁶⁴−1 bits, with all lengths required to be multiples of 8.
- Supported tag lengths are 128, 120, 112, 104, or 96 bits in general; 64- and 32-bit tags are permitted only under Appendix C constraints. For 32-bit tags, a maximum combined ciphertext+AAD of 2⁵ bytes allows 2²² invocations, down to 2¹⁰ bytes allowing 2¹¹ invocations; for 64-bit tags, 2¹⁵ bytes allows 2³² invocations, down to 2²⁵ bytes allowing 2¹⁷ invocations.
- The IV uniqueness requirement states the probability that the authenticated encryption function is ever invoked with the same IV and key on two or more distinct input sets shall be no greater than 2⁻³²; a single repeated IV may expose the implementation to forgery attacks (Joux), and the document says this requirement is "almost as important as the secrecy of the key."
- Unless an implementation uses only 96-bit IVs from the deterministic construction, total invocations of authenticated encryption shall not exceed 2³² across all IV lengths and instances with a given key; a reasonable overall limit of 2⁶⁴ blocks of plaintext and AAD per key is suggested.
Methods
- This is a standards specification, not an empirical study: it defines Algorithms 1–5 (block multiplication over GF(2¹²⁸), GHASH, GCTR, GCM authenticated encryption, and GCM authenticated decryption), with inputs, outputs, steps, diagrams, and summaries.
- It specifies requirements for the underlying block cipher (approved, 128-bit block size, key ≥128 bits, fresh and secret), two IV construction frameworks (deterministic and RBG-based), key establishment, and conformance categories (GCM and GMAC).
- No data, sample, or statistical analysis is reported; the document is normative guidance with appendices summarizing security rationale and short-tag constraints.
Limitations
- Stated: authentication assurance is "strong, but not absolute" — a targeted ciphertext forgery is expected to succeed with probability approximately n/2ᵗ, where n is the total number of blocks in the GHASH encoding of ciphertext and AAD, so GCM is "not well-suited for use with short tag lengths or very long messages," and each successful forgery increases the probability of subsequent ones and leaks information about the hash subkey H.
- Stated: GCM does not inherently prevent replay of a valid authenticated-encryption output; the controlling protocol must monitor IV duplication or incorporate identifying information (e.g., sequence numbers, timestamps) into the AAD.
- Stated: the simplified GHASH in this Recommendation does not obtain all of the properties shown for the designers' definition of GHASH in Ref. [7]; also, security assurance degrades as more data is processed with a single key.
Model-written summary. Check it against the paper before relying on it.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
45 Own interpretation · 11 Sources not found · 10 No basis given
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In other words, the adversary essentially could control the plaintext output of the authenticated decryption function.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
hedgeddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Independent of this attack, an adversary may attempt to systematically guess many different tags for a given input to authenticated decryption, and thereby increase the probability that one (or more) of them, eventually, will be accepted as valid.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“If the output is FAIL, then it is certain that at least one of the given inputs (i.e., the ciphertext, the AAD, the IV, or the tag) is not authentic.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Compliance with this requirement is crucial to the security of GCM.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 8 Uniqueness Requirement on IVs and Keys
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Rests on an assumption: The underlying approved block cipher is secure.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Moreover, each successful forgery in this attack 1) increases the probability that subsequent targeted forgeries will succeed, and 2) leaks information about the hash subkey, H.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The adversary then could easily construct a ciphertext forgery.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
hedgeddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
In the paper
“For the RBG-based construction of IVs, the above requirement, in conjunction with the requirement that r(i)≥96, is sufficient to ensure the uniqueness requirement in Sec. 8, as follows from the discussion in Ref. [4].”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 8.3 Constraints on the Number of Invocations
What the sources say
- Not matchedcites [4]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Not matched
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In other words, an adversary, i.e., a party without access to the key or to the authenticated encryption function, may be able to produce the correct tag for some triple of ciphertext, AAD, and IV.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In other words, GCM, like many other authentication mechanisms, does not inherently prevent an adversary from intercepting the output of an invocation of authenticated encryption and”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In the above scenario, knowing the original plaintext that corresponds to the given ciphertext, the adversary can construct the substitute ciphertext in such a way as to correspond to any desired plaintext of the same length.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Probably not a substantial claim. 30
- It may state two separate claims as one. 7
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“GCM provides assurance of the confidentiality of data using a variation of the Counter mode of operation for encryption.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 3 Introduction
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
- Rests on an assumption: The underlying approved block cipher is secure.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The hash subkey, denoted H, is generated by applying the block cipher to the”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 5.3 Primitives for Confidentiality and Authentication
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Compliance with these two requirements implies compliance with the uniqueness requirement on IVs in Sec. 8.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“GCM can also provide authentication assurance for additional data (of practically unlimited length per invocation) that is not encrypted.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 3 Introduction
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
- Rests on an assumption: The underlying approved block cipher is secure.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“As described in Appendix B, the successful verification of the tag within the authenticated decryption function gives assurance of the authenticity of the data; however, the party that presents the input data to the authenticated decryption function may not be the original source of the plaintext and AAD.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
plainconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Each of these functions is relatively efficient and parallelizable; consequently, high-throughput implementations are possible in both hardware and software.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 3 Introduction
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Consequently, GCM is not well-suited for use with short tag lengths or very long messages.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“For some voice or video applications, short authentication tags can be appropriate.The forgery of some fraction of the individual authenticated”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
plainconditional- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence. The paper’s conclusions may not depend on it.
In the paper
“The mechanism for the confidentiality of the plaintext within GCM is a variation of the Counter mode [10], with a particular incrementing function, denoted inc 32 , for generating the necessary sequence of counter blocks.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 5.3 Primitives for Confidentiality and Authentication
What the sources say
- Not matchedcites [10]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Not matched
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The secure operation of a cryptographic algorithm depends not only on the proper implementation of the steps of the algorithm, but also on the adherence to the associated requirements.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In some protocols an adversary may even be able to use data that the verifier itself generated earlier in the protocol.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In practice, the requirements in Sec.5.1 should ensure that a key is fresh when it is generated, if the generation mechanism is resistant to tampering.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 8.1 Key Establishment
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The authentication mechanism within GCM is based on a hash function, called GHASHfoot_0 , that features multiplication by a fixed parameter, called the hash subkey, within a binary Galois field.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 5.3 Primitives for Confidentiality and Authentication
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“GCM provides stronger authentication assurance than a (non-cryptographic) checksum or error detecting code; in particular, GCM can detect both 1) accidental modifications of the data and 2) intentional, unauthorized modifications.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 3 Introduction
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may state two separate claims as one.
- Rests on an assumption: The underlying approved block cipher is secure.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“In effect, the GHASH function calculates X 1 •H m ⊕ X 2 •H m-1 ⊕ ... ⊕ X m-1 •H 2 ⊕ X m •H.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Output: block GHASH H (X).
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The GCM functions require only the forward direction of the underlying block cipher (i.e., the inverse direction is not required).”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 3 Introduction
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The • operation on (pairs of) the 2 128 possible blocks corresponds to the multiplication operation for the binary Galois (finite) field of 2 128 elements.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Steps:
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In practice, this requirement is almost as important as the secrecy of the key.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 8 Uniqueness Requirement on IVs and Keys
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
- Rests on an assumption: The underlying approved block cipher is secure.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The GCM functions are”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 3 Introduction
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“If some or all of the additional, non-confidential data is fixed, then the corresponding elements of the GCM authentication mechanism can be pre-computed.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 3 Introduction
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“GHASH is a keyed hash function but not, on its own, a cryptographic hash function.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 5.3 Primitives for Confidentiality and Authentication
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“For GCM, the requirement in Sec.5.2.1 for the uniqueness of the IVs is almost as important, although not as obvious.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“If the output is the plaintext, then the design of the mode provides strong, but not absolute, assurance that the purported source of the data created the tag, i.e., that the plaintext and the AAD (and the IV and the tag) are authentic.Consequently, the mode also provides strong assurance that this information was not subsequently altered, either intentionally or unintentionally.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
boostedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“For example, GCM keys may be established using the key derivation functions of the following protocols as allowed in [9]: Transport Layer Security, Internet Key Exchange v1 and v2, and Secure Shell.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 8.1 Key Establishment
What the sources say
- Not matchedcites [9]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Not matched
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The authenticity of the protected data can be verified independently from the recovery of the confidential data from its encrypted form.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 3 Introduction
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“GCM does not employ the inverse cipher function.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 5.1 Block Cipher
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Eventually, H may be compromised entirely, with consequences as described at the end of Appendix A: the authentication assurance is completely lost.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“As with any tag-based authentication mechanism, if the adversary chooses a t-bit tag at random, it is expected to be correct for given data with probability 1/2 t .”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“If the unique initialization string is predictable, and the length of the confidential data is known, then the block cipher invocations within the GCM encryption mechanism can be pre-computed.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 3 Introduction
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Moreover, as with most block cipher modes of operation, the security assurance of GCM degrades as more data is processed with a single key.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 10 Conformance
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The creation of an authentication tag by the authenticated encryption function provides the mechanism whereby assurance of the authenticity of the plaintext and AAD (and IV) can be obtained upon the execution of the authenticated decryption function.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > Additional information
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“One potential advantage of the RBG-based construction is that the RBG may be designed to recover from a loss of power in a straightforward manner, i.e., without requiring action from the IT professional that maintains the system.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 9.1 Design Considerations
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Compliance with the uniqueness requirement on IVs, and hence the security of GCM, ultimately depends on the IT professional who configures, deploys, and maintains the GCM modules within a particular system.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 9.2 Operational Considerations
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“For the deterministic construction, all of the deterministic elements that are necessary to construct the IV would have to be available when power is restored.”
§ Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC > 9.1 Design Considerations
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper relies on this without support.
The underlying approved block cipher is secure.
“GCM is constructed from an approved symmetric key block cipher with a block size of 128 bits, such as the Advanced Encryption Standard (AES) algorithm that is specified in Federal Information Processing Standard (FIPS) Pub.197 [2].”
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“To eliminate the risk of nonce reuse, the framework employs a stochastic generation approach compliant with NIST SP 800-38D guidelines (Dworkin, 2007).”
From A high-throughput AES-GCM implementation on GPUs for secure, policy-based access to massive astronomical catalogs (2026) · cites this paper as Dworkin, 2007
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Archives approaching N ∼ 2 32 files per key fall into the regime where NIST SP 800-38D §8.3 recommends key rotation; our framework supports this through the explicit key reference required by every encryption operation.”
From A high-throughput AES-GCM implementation on GPUs for secure, policy-based access to massive astronomical catalogs (2026) · cites this paper as Dworkin, 2007
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Third, standardization: AES-GCM is specified by NIST SP 800-38D (Dworkin, 2007) as an approved AEAD mode, whereas CTR + HMAC, although built from approved primitives, is not itself a standardized AEAD construction.”
From A high-throughput AES-GCM implementation on GPUs for secure, policy-based access to massive astronomical catalogs (2026) · cites this paper as Dworkin, 2007
Experimental — accuracy not yet measuredThe cited source says what the claim attributes to it.
In the citing paper
“The framework implements the AES-128-GCM standard (Dworkin, 2007).”
From A high-throughput AES-GCM implementation on GPUs for secure, policy-based access to massive astronomical catalogs (2026) · cites this paper as Dworkin, 2007
The cited source says what the claim attributes to it.
In the citing paper
“The security of the AES-GCM mode relies strictly on the uniqueness of the initialization vector for a given key.”
From A high-throughput AES-GCM implementation on GPUs for secure, policy-based access to massive astronomical catalogs (2026) · cites this paper as Dworkin, 2007
Citations
Cites
THE ADVANCED ENCRYPTION STANDARD
Stallings, W. (2002) · Cryptologia · doi:10.1080/0161-110291890876 · Cited by 770
Recommendation for block cipher modes of operation: methods and techniques
Dworkin, M. J. (2001) · doi:10.6028/nist.sp.800-38a · Cited by 746
Self-citationThe Security and Performance of the Galois/Counter Mode (GCM) of Operation
McGrew, D. A., & Viega, J. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-30556-9_27 · Cited by 530 · cited 1×
“[7] gives a detailed treatment of the security properties of GCM.”
BackgroundSecurity Requirements for Cryptographic Modules
Daley, W. M., Shavers, C., & Kammer, R. G. (1999) · Defense Technical Information Center (DTIC) · Cited by 405
The Galois/Counter Mode of Operation (GCM)
McGrew, D. A., & Viega, J. (2005) · Cited by 332
Security Requirements for Cryptographic Modules
National Institute of Standards and Technology (US) (2019) · Federal Information Processing Standards Publication (FIPS PUB) 140-3 · doi:10.6028/nist.fips.140-3 · Cited by 118
The Advanced Encryption Standard (AES)
Paar, C., & Pelzl, J. (2009) · Springer eBooks · doi:10.1007/978-3-642-04101-3_4 · Cited by 80
Research works printed but not linked: 1
- IEEE P1619.1™/D23, Draft Standard for Authenticated Encryption with Length Expansion for Storage Devices.
Cited by
Sorted by citations
Report on lightweight cryptography
McKay, K. A., Bassham, L., Turan, M. S., & Mouha, N. (2017) · doi:10.6028/nist.ir.8114 · Cited by 353
“NIST also approves standalone MACs, CMAC [19], GMAC [17], and HMAC [68], to be used for generating and verifying tags to provide message authentication.”
MethodInfluentialThe Software Performance of Authenticated-Encryption Modes
Krovetz, T., & Rogaway, P. (2011) · Lecture notes in computer science · doi:10.1007/978-3-642-21702-9_18 · Cited by 266
Recommendation for key management: part 1 - general
Barker, E. (2020) · doi:10.6028/nist.sp.800-57pt1r5 · Cited by 271
Chaskey: An Efficient MAC Algorithm for 32-bit Microcontrollers
Mouha, N., Mennink, B., Herrewege, A. V., Watanabe, D., Bart Preneel, A., & Verbauwhede, I. M. R. (2014) · Lecture notes in computer science · doi:10.1007/978-3-319-13051-4_19 · Cited by 204
“This includes MAC algorithms such as UMAC [16], Poly1305- AES [11], and GMAC [34].”
MethodInfluentialThe Hummingbird-2 Lightweight Authenticated Encryption Algorithm
Engels, D. W., Saarinen, M.-J. O., Schweitzer, P. P., & Smith, E. M. (2012) · Lecture notes in computer science · doi:10.1007/978-3-642-25286-0_2 · Cited by 191
Metadata
- Authors
- Dworkin, M. J.
- Published
- 2007
- OpenAlex
- W2727655671
- Semantic Scholar
- e140766a2342c14037d83524d339e500e812589f
- Cited by
- 463
- References
- 8
- Citations by year
- 2026: 80 · 2025: 31 · 2024: 25 · 2023: 27 · 2022: 19 · 2021: 28 · 2020: 27 · 2019: 33 · 2018: 24 · 2017: 24 · 2016: 18 · 2015: 29 · 2014: 27 · 2013: 13 · 2012: 15
- Type
- report
- Language
- en
- Open access
- gold
- doi.org
- Licence
- public-domain
- Funders
- Government of Canada
- National Institute of Standards and Technology
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Cryptographic Implementations and Security
- Physical Sciences › Mathematics › Discrete Mathematics and Combinatorics › Coding theory and cryptography
- Physical Sciences › Computer Science › Computer Networks and Communications › Cryptography and Data Security
- Keywords
- block cipher, modes of operation, cryptographic standards, block cipher modes of operation
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
A language model drew the claims from the paper on 2026-10-20, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).
A second model labelled each claim on 2026-10-20 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
