Close to Optimally Secure Variants of GCM

Table 1

Comparisons among AES-GCM [34], AES-OGCM-1, and AES-OGCM-2. The nonce length is restricted to 96 bits. “n.r.” denotes nonce-respecting. “” means can be reduced to . Let be the block length of the plaintext and be the block length of associated data.

	AES-GCM [34]	AES-OGCM-1	AES-OGCM-2
# keys	1
CTR-like	Yes	Yes	Yes
Block size	128	128	128
Nonce scenario	n.r.	n.r.	n.r.
Assumption	PRP	PRP	PRP
Security (bits)	64	107.9565	121.9339
# block cipher calls
# multiplications