Editing Block cipher mode of operation (section)

==== AES-GCM-SIV ====

[[AES-GCM-SIV]] is a mode of operation for the Advanced Encryption Standard which provides similar performance to Galois/counter mode as well as misuse resistance in the event of the reuse of a cryptographic nonce. The construction is defined in RFC 8452.<ref>{{cite IETF |title=AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption |rfc=8452 |last1=Gueron |first1=S. |date=April 2019 |publisher=[[Internet Engineering Task Force|IETF]] |access-date=August 14, 2019 |doi=10.17487/RFC8452}}</ref>

AES-GCM-SIV synthesizes the internal IV. It derives a hash of the additional authenticated data and plaintext using the POLYVAL Galois hash function. The hash is then encrypted an AES-key, and used as authentication tag and AES-CTR initialization vector.

'''AES-GCM-SIV''' is an improvement over the very similarly named algorithm '''GCM-SIV''', with a few very small changes (e.g. how AES-CTR is initialized), but which yields practical benefits to its security "This addition allows for encrypting up to 2<sup>50</sup> messages with the same key, compared to the significant limitation of only 2<sup>32</sup> messages that were allowed with GCM-SIV."<ref>{{cite journal |last1=Gueron |first1=Shay |last2=Langley |first2=Adam |last3=Lindell |first3=Yehuda |title=AES-GCM-SIV: Specification and Analysis |journal=Cryptology ePrint Archive |date=14 Dec 2018 |volume=Report |issue=2017/168 |url=https://eprint.iacr.org/2017/168 |access-date=19 October 2020}}</ref>