AES-GCM bug for len(IV) != 96
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	• gniibe
	Jan 30 2018, 12:14 PM

Description

In NIST SP 800-38D, section 6.5 GCTR Function:

Algorithm 3: GCTR K (ICB, X)

For i = 2 to n, let CB i = inc 32 (CB i-1 ).

But libgcrypt implementation doesn't compute inc32 correctly.

External Link: https://lists.gnupg.org/pipermail/gcrypt-devel/2018-January/004383.html
Version: 1.7

rC libgcrypt
	rC0a391b259adc Fix incorrect counter overflow handling for GCM
	rC3caf35a49cb6 Fix incorrect counter overflow handling for GCM
	rCffdc6f3623a0 Fix incorrect counter overflow handling for GCM

I backported the fix for 1.8.3.

( I wonder why this does not show up here - because of the cherry-pick with option -x?)