6 ms·
That would make AES-XGCM an immediate replacement of AES-GCM that already supports an arbitrary long nonce.
by amadvance 3y ago
That would make AES-XGCM an immediate replacement of AES-GCM that already supports an arbitrary long nonce.
- some_furry 3y agoThe "arbitrary long nonce" gets hashed down (using GHASH) to 96 bits. I mean, sure, if you really want to, you can already do that with the GCM part. I would hesitate to do that to the AES-CBC-MAC part. Your proposal would then be to dedicate the first 16 bytes (128 bits) to the extension, and the rest to GCM.