AES-GCM in stream mode

[jiep]

Hello,

First, I am grateful for your excellent work on this library. The quality and attention to detail are truly impressive and have been a great help in my projects.

I have a question regarding the use of the library. Is it possible to use AES-GCM in stream mode, similar to how it can be done in Node.js? This feature would be handy for my current project, and I'm hoping there's a way to implement it in your library.

For reference, here is an example of how this is achieved in Node.js:

// https://nodejs.org/api/crypto.html#class-cipher
const cipher = crypto.createCipheriv(mode, key, iv);
const outputChunk1 = cipher.update(inputChunk1); // Is stream mode supported on Noble?
const outputChunk2 = cipher.update(inputChunk2);
// ...
const outputChunkN = cipher.update(inputChunkN);
cipher.final();
const tag = cipher.getAuthTag();

Thank you again for your hard work and for providing such a fantastic library. I look forward to your response.

Best regards.

[larabr]

I'm also interested in a streaming interface, and for other AES modes as well.
For now I I implemented support myself in my code using the exported unsafe functions, but I'd rather not have to think about it 😁

[paulmillr]

I think the current architecture keeps RAM usage small. So, besides RAM usage, what would be usage for this?

Also, seems complex to implement on top of current architecture. We'd be having an audit ASAP.

[larabr]

Not sure if we are on the same page about RAM usage; if we get 1gb of streamed data to process, with the current interface I need to wait for and buffer the whole input to encrypt/decrypt. This is unnecessary for unauthenticated AES modes (eg CBC).

For authenticated modes like GCM, there's a trickier matter when it comes to decryption, as to stream the decrypted data you'd have to release data early (before the tag has been verified). So the function can be used insecurely if the consumer is not aware of this.

Also, seems complex to implement on top of current architecture.

Yes, definitely. It's part of the reason why I am not opening a PR myself for this 😓

[alterstep]

AES-GCM is not safe for large inputs

[larabr]

I don't think this is that relevant when it comes to decide for/against streaming support tbh; it's always possible to throw on encryption for an input above the size limit to add a safeguard, but that doesn't prevent a user from encrypting too many messages with the same key, for instance.

[paulmillr]

So, to make a line: it would be nice to get this, but it needs a nice API and such.

I like what you've did in openpgp. It tells ciphers are versatile enough for all kinds of cases. And after the audit, "unsafe" methods would still get audited.