ISSUE-155: Add AES-GCM to XML Encryption 1.1

from email: http://lists.w3.org/Archives/Public/public-xmlsec/2009Nov/0030.html

Here is a preliminary proposal for adding AES-GCM (I had a brief
discussion about GCM with Brian in the F2F)


Section 5.1, (add this to the list of algorithms.)

http://www.w3.org/2009/xmlenc11#aes128-gcm
http://www.w3.org/2009/xmlenc11#aes256-gcm


Section 5.2.3 AES-GCM (add new section)

AES-GCM is an authenticated encryption mechanism. I.e. it is equivalent
to doing these two operations in one step - HMAC signing followed by
AES-CBC encryption. It is very attractive from performance point of
view, because the cost of AES-GCM is similar to regular AES-CBC
encryption, yet it achieves the same result as encryption + HMAC
signing.. Also AES-GCM can be pipelined so it is amenable to hardware
acceleration..

Identifiers.
http://www.w3.org/2009/xmlenc11#aes128-gcm
http://www.w3.org/2009/xmlenc11#aes256-gcm


AES-GCM is used with a 96 bit Initialization Vector (IV), and a 128 bit
Authentication Tag (T). The cipher text contains the IV first, followed
by the T and then finally the encrypted octets. Decryption should fail
if the authentication tag computed during decryption does not match the
specified Authentication Tag.

----
Maybe adding a reference to, e.g. NIST SP 800-38D (there are also some details in RFC 5288 on the use of nonces and authentication tags)?

http://lists.w3.org/Archives/Public/public-xmlsec/2009Nov/0036.html
----
One more thing - from the NSA Suite B docs, it appears to me that they
prefer AES-GCM mode over the AES-CBC mode, because they recommend it in TLS.
Brian/Kevin/Magnus who have looked at the NSA Suite B docs carefully can
also review this.

http://lists.w3.org/Archives/Public/public-xmlsec/2009Nov/0037.html
---

Added.