View source for AES-GCM-SIV

{{short description|Authenticated encryption mode with resistance against nonce reuse}}
'''AES-GCM-SIV''' is a [[block cipher mode of operation|mode of operation]] for the [[Advanced Encryption Standard]] which provides similar (but slightly worse<ref>{{cite web | url=https://yehudalindell.com/webpage-for-the-aes-gcm-siv-mode-of-operation/ | title=Webpage for the AES-GCM-SIV Mode of Operation | date=31 May 2023 }}</ref>) performance to [[Galois/Counter Mode]] as well as misuse resistance in the event of the reuse of a [[cryptographic nonce]]. The construction is defined in RFC 8452.<ref>{{cite IETF|title=AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption|rfc=8452|last1=Gueron|first1=S.|date=April 2019|publisher=[[Internet Engineering Task Force|IETF]]|access-date=August 14, 2019|doi=10.17487/RFC8452|first2=A.|last2=Langley|first3=Y.|last3=Lindell}}</ref>

==About==
AES-GCM-SIV is designed to preserve both privacy and integrity even if nonces are repeated. To accomplish this, encryption is a function of a nonce, the plaintext message, and optional additional associated data (AAD). In the event a nonce is misused (i.e., used more than once), nothing is revealed except in the case that the same message is encrypted multiple times with the same nonce. When that happens, an attacker is able to observe repeat encryptions, since encryption is a deterministic function of the nonce and message. However, beyond that, no additional information is revealed to the attacker. For this reason, AES-GCM-SIV is an ideal choice in cases that unique nonces cannot be guaranteed, such as multiple servers or network devices encrypting messages under the same key without coordination.

==Operation==
Like Galois/Counter Mode, AES-GCM-SIV combines the well-known [[Block cipher modes of operation#Counter (CTR)|counter mode]] of encryption with the Galois mode of authentication. The key feature is the use of a synthetic [[initialization vector]] (SIV) which is computed with [[Galois field]] multiplication using a construction called POLYVAL (a [[Endianness|little-endian]] variant of Galois/Counter Mode's GHASH). POLYVAL is run over the combination of nonce, plaintext, and additional data, so that the IV is different for each combination.

POLYVAL is defined over GF(2<sup>128</sup>) by the polynomial:

: <math>x^{128} + x^{127} + x^{126} + x^{121} + 1</math>

Note that GHASH is defined over the "reverse" polynomial:

: <math>x^{128} + x^7 + x^2 + x + 1</math>

This change provides efficiency benefits on little-endian architectures.<ref>{{cite web | url=https://engineering.linecorp.com/en/blog/AES-GCM-SIV-optimization | archive-url=https://web.archive.org/web/20231118183816/https://engineering.linecorp.com/en/blog/AES-GCM-SIV-optimization | archive-date=2023-11-18 | title=How we optimized the AES-GCM-SIV encryption algorithm }}</ref>

==See also==
* [[Authenticated encryption]]
* [[Stream cipher]]

== References ==
{{reflist}}

==External links==
Implementations of AES-GCM-SIV are available, among others, in the following languages:

* [https://github.com/Shay-Gueron/AES-GCM-SIV/ C]
* [https://github.com/Metalnem/aes-gcm-siv C#]
* [https://github.com/ericlagergren/siv Go]
* [https://github.com/secure-io/siv-go Go]
* [https://github.com/codahale/aes-gcm-siv Java]
* [https://github.com/denobisipsis/PHP_AES-GCM-SIV PHP]
* [https://github.com/chris-wood/aes-gcm-siv Python]
* [https://github.com/RustCrypto/AEADs/tree/master/aes-gcm-siv Rust]

{{Cryptography navbox | block | hash}}

[[Category:Block cipher modes of operation]]
[[Category:Finite fields]]
[[Category:Message authentication codes]]
[[Category:Authenticated-encryption schemes]]