I'd like to use AES-GCM instead of HMAC for authentication and privacy in a token used in a web application, but I'm unsure how to securely tag each token with an IV. Is it safe for me to prepend the IV in front of the AES-GCM data, or do I need to protect it somehow?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
It is indeed safe to send it along with the ciphertext; the attacker can't learn anything from it (other than possibly how many packets has been generated so far, if you use a counter to generate the IVs), and if the attacker modifies the IV, the resulting message will fail to decrypt (with high probability).
Existing protocols that can use GCM (TLS, IPSec) do exactly that: prepend the IV in front of the AES-GCM data.