Q1: Is the IV returned by cipher.getIV() safe for me to use in this way? Yes, it is at least for the Oracle provided implementation. It is generated separately using the default SecureRandom implementation. As it is 12 bytes in size (the default for GCM) then you have 96 bits of randomness. The chance that … Read more
This answer reflects the comments from Luke Park, bartonjs, Timo, aand Maarten Bodewes above. One option is to use the Bouncycastle C# library, which has its own self-contained implementation of AES as well as the GCM mode. Look at the source code for the classes GCMBlockCipher, AesEngine, and AEADParameters. Another option is to use P/Invoke … Read more
Micro-benchmarking aside, the performance of the GCM implementation in JDK 8 (at least up to 1.8.0_25) is crippled. I can consistently reproduce the 3MB/s (on a Haswell i7 laptop) with a more mature micro-benchmark. From a code dive, this appears to be due to a naive multiplier implementation and no hardware acceleration for the GCM … Read more