AES-Gem (AES with Galois Extended Mode)

This is a great proposal.<p>It would have been a good opportunity to leverage the AES-PRF construction (see tosc.v2018.i2.161-191 in addition to the original paper), whose overhead is negligible. But unfortunately, FIPS restrictions is why we can&#x27;t have nice things.<p>If FIPS compliance is not a requirement, AEGIS (AEGIS-256 in particular) is a more efficient alternative and on the standard track.<p>But when only FIPS-approved things can be used, AES-GEM is a nice way to solve a very common problem.

Zig implementation: <a href="https:&#x2F;&#x2F;github.com&#x2F;jedisct1&#x2F;zig-aes-gem">https:&#x2F;&#x2F;github.com&#x2F;jedisct1&#x2F;zig-aes-gem</a>

I like these proposals to extend the current systems. They will probably never lead anywhere, but they are still a nice reminder that we are still learning things.<p>My vacation plans include trying to grok at least a little bit of the xocb paper: <a href="https:&#x2F;&#x2F;dl.acm.org&#x2F;doi&#x2F;10.1007&#x2F;978-3-031-30634-1_18" rel="nofollow">https:&#x2F;&#x2F;dl.acm.org&#x2F;doi&#x2F;10.1007&#x2F;978-3-031-30634-1_18</a>

How does this compare to other GCM alternatives such as AES-SIV and AES GCM-SIV?

Don&#x27;t see also, because it&#x27;s completely unrelated, GEM AES: <a href="https:&#x2F;&#x2F;www.seasip.info&#x2F;Gem&#x2F;aes.html" rel="nofollow">https:&#x2F;&#x2F;www.seasip.info&#x2F;Gem&#x2F;aes.html</a>

Remember: You should never been on the bleeding edge with crypto. It takes years to find attacks in ciphers, and more years to find attacks in implementations.<p>Never roll your on crypto. Always move slow and trust the process.