Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to use AES-GCM instead of HMAC for authentication and privacy in a token used in a web application, but I'm unsure how to securely tag each token with an IV. Is it safe for me to prepend the IV in front of the AES-GCM data, or do I need to protect it somehow?

share|improve this question
up vote 6 down vote accepted

It is indeed safe to send it along with the ciphertext; the attacker can't learn anything from it (other than possibly how many packets has been generated so far, if you use a counter to generate the IVs), and if the attacker modifies the IV, the resulting message will fail to decrypt (with high probability).

Existing protocols that can use GCM (TLS, IPSec) do exactly that: prepend the IV in front of the AES-GCM data.

share|improve this answer
Complementary comment following previous implementation of gcm-aes : iv has as indicated to be appended in clear form with the ciphertext but in addition it must be part of the clear AD data sequence included in mac computation so to prevent at 100% from iv modification. lastly gcm cannot really be compared with hmac which only performs mac based authentication and not encryption – william_fr Jul 6 '13 at 11:51
@william_fr: well, no, for GCM, you don't need to include the IV as a part of the AAD; any modification to the IV with modify the authentication tag anyways. Of course, it doesn't hurt anything to include the IV in the AAD either. – poncho Jul 6 '13 at 13:54
you are right as iv is internally used by ghash function (gcm/gmac specifity). In my application the complete security header (key number, iv , anti replay counter ...) is de facto included in AD data but as you indicate it was not mandatory for the iv (redundant protection).thanks for the correction. – william_fr Jul 6 '13 at 15:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.