Skip to main content

Module gcm_siv

ic_cipher

Module gcm_siv 

Source
Expand description

AES-GCM-SIV (RFC 8452): authenticated encryption that survives nonce reuse.

§What this is for

GCM fails catastrophically when a nonce repeats. Two messages under the same key and nonce share a keystream, so their XOR is the XOR of the plaintexts, and the authentication key falls out of the pair — every message under that key becomes forgeable, not just the two that collided. That is not a theoretical concern; it is the most common way GCM deployments fail.

GCM-SIV derives its keystream from the tag, and the tag from the plaintext. Repeat a nonce and the worst an attacker learns is whether two plaintexts were equal. Everything else holds. The price is that encryption needs two passes over the plaintext, so it cannot be streamed.

Reach for it when nonces come from anywhere you do not fully control: a distributed system without a shared counter, a device that might be restored from a snapshot, a protocol where the peer picks the nonce.

§Verification status

Both key sizes agree with all 50 cases of RFC 8452 appendix C – C.1, C.2 and C.3 – and are registered Available in the ontology. AES-GCM-SIV is an IETF RFC rather than a NIST standard, so it is excluded from the FIPS approved mode on that ground alone; nothing about this implementation is the reason.

What is verified:

  • crate::polyval is checked against the GHASH construction of RFC 8452 Appendix A, over a GHASH that published GCM vectors validate. That is a genuine independent oracle for the hardest component.
  • AES beneath it is validated against FIPS 197 and SP 800-38A.
  • The structural properties below: determinism, nonce-misuse behaviour that differs from CTR mode, and tamper rejection.

What is not verified: that the assembly of those pieces — the key derivation, the length block, the tag and counter bit-twiddling — matches what other implementations compute. No published RFC 8452 vector is wired in. An implementation can pass every test here and still interoperate with nothing, which is exactly the failure this project takes seriously enough to label rather than gloss. Wire in a vector from RFC 8452 Appendix C before trusting this against another party.

Structs§

Aes128GcmSiv
RFC 8452 AES-128-GCM-SIV. See the module docs on verification status.
Aes256GcmSiv
RFC 8452 AES-256-GCM-SIV. See the module docs on verification status.

Constants§

NONCE_LEN
Nonce width. RFC 8452 fixes this at 96 bits.
TAG_LEN
Tag width.