Sophie Germain Counter Mode

A new mode called Sophie Germain Counter Mode (SGCM) has been proposed as a variant of the Galois/Counter Mode of operation for block ciphers. Instead of the binary field GF(2¹²⁸), it uses modular arithmetic in GF(p) where p is a safe prime 2¹²⁸ + 12451 with corresponding Sophie Germain prime p − 1/2 = 2¹²⁷ + 6225.^[1]

SGCM does prevent the specific "weak key" attack described in its paper, however there are other ways of modifying the message that will achieve the same forgery probability against SGCM as is possible against GCM: by modifying a valid n-word message, you can create a SGCM forgery with probability circa n / 2¹²⁸.^[2] That is, its authentication bounds are no better than those of Galois/Counter Mode. SGCM when implemented in hardware has a higher gate count than GCM. However, its authors expect software implementations of SGCM to have similar or superior performance to GCM on most software platforms.

References