Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I encrypt a message with AES-GCM, is it safe to use the MAC as the hash in a DSA/RSA signature? That is, if someone knows the AES key and nonce, will they be able to generate a different message with the same key/nonce that results in the same MAC?

How about other modes like CCM/OCB or authenticated stream ciphers?

share|improve this question
up vote 7 down vote accepted

Well, no, it is not safe to use a GCM authentication tag as a hash. If you know the key, it is straight-forward to find preimages; that is, find a message that hashes to a specific target value. Note that you asked for second preimage resistance; not only does it fail to provide that, it fails to provide the weaker preimage resistance.

CCM and OCB have exactly the same property; in all three cases, the authentication tags were designed to act as Message Authentication Codes, not Cryptographical Hashes; note that these are two different concepts. In particular, a Message Authentication Code is supposed to prevent someone who doesn't know the key from creating valid tag values; nothing in the definition says it has any security properties against someone who does know the key (and, again, in the case of GCM/CCM/OCB, they don't).

In fact, they fail to provide preimage resistance in this strong sense; if you are given the target tag value, keys, the nonce and a message template that specifies the entire message except for an aligned 128 bit region, with GCM, CCM or OCB, you can compute what value that aligned 128 bit region must be in order for the tag to be a specified target value.

I'm leaving out authenticated stream ciphers from this discussion; I haven't examined all of them, and so I can't make a blanket statement of them. I would be personally doubtful, though; unless something was designed specifically to be collision resistant, more than likely it won't be.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.