Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

The AES GCM example for Ruby / OpenSSL shown at: http://ruby-doc.org/stdlib-2.0/libdoc/openssl/rdoc/OpenSSL/Cipher.html has a GCM example of the following:

cipher = OpenSSL::Cipher::AES.new(128, :GCM)
cipher.encrypt
key = cipher.random_key
iv = cipher.random_iv
cipher.auth_data = ""

encrypted = cipher.update(data) + cipher.final
tag = cipher.auth_tag

decipher = OpenSSL::Cipher::AES.new(128, :GCM)
decipher.decrypt
decipher.key = key
decipher.iv = iv
decipher.auth_tag = tag
decipher.auth_data = ""

plain = decipher.update(encrypted) + decipher.final

puts data == plain #=> true

In the example, auth_data (authentication data) is set to nothing.

My question is: Does this make the encryption less secure by using blank auth data?

Any help is greatly appreciated. Thanks!

share|improve this question
    
Note that the IV does not need to be part of the AAD for GCM mode encryption. It is required for CBC/HMAC schemes, so the inclusion of the IV in the associated data depends on the protocol. –  owlstead Apr 21 at 22:43

2 Answers 2

up vote 6 down vote accepted

AEAD modes like GCM are authenticated encryption with associated data; this setting only affects the associated data half of that. The ciphertext itself is still authenticated. The associated data portion is there to provide contextual information for the authentication of the ciphertext. Usually this data is something that's outside of direct control of the party providing the ciphertext to be decrypted.

As a contrived example, it could be the database ID of the user whose data is encrypted. This way, even if another user found a way to copy a victim's secret key and ciphertext into his own account, he wouldn't be able to successfully decrypt the ciphertext since the user IDs would not be the same. Alternatively, in something like an over-the-wire communication protocol, a sequence number could be used as the associated data. This would prevent some types of replay attacks at the cryptographic layer — any attempt to replay a ciphertext would fail, since the other side can reject packets with duplicated sequence numbers, and any other sequence number would fail to decrypt the cryptogram.

To get around to answering your question, "less secure" than what? Not using authenticated data doesn't render the underlying ciphertext inherently weaker than had you used another, non-AEAD mode. But if there's additional context that could be included and you're not using it, it could be more secure if you did use it.

As always, it's important to understand what your threat model is before you involve cryptography. What are you trying to protect? From whom are you protecting it? What are the possible threats, and the vectors an attacker might use to compromise the protected data?

share|improve this answer

No it is not less secure. GCM and a number of other authenticated modes typically let you specify optional data which is authenticated but not encrypted. That is all this is. So the code is making it explicit that there is no data that is only authenticated.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.