Tag
gcm
- Oct 6, 2025 GHASH and the Structure of a GCM Tag Why the authenticator is a polynomial evaluation in a binary field rather than a chained MAC, how the length block prevents padding ambiguity, and what tag truncation costs in forgery probability. cryptography
- May 19, 2025 Recovering the GCM Authentication Key from a Repeated Nonce Two messages encrypted under the same GCM nonce turn the tag difference into a polynomial in the hash subkey, whose roots yield the key and permit arbitrary forgery. cryptography
- Jul 18, 2024 Key Commitment and Why an AEAD Can Decrypt Under Two Keys AEAD schemes are not committing by default, so a ciphertext forged to verify under two different keys splits the receiver into two views of the same message, with consequences for key rotation and message franking. cryptography