Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am just learning about the GCM mode of AES and I'd like to start using it in my software. However, I have a question about its use. As I understand it the output of a GCM encryption operation is the ciphertext plus an "authentication tag." I know that the key needs to be guarded from discovery, but does this authentication tag need to be protected like the key does? Or, would it be safe to prepend the ciphertext with the tag and IV and then send that whole blob through unprotected channels?

share|improve this question
I think the usual way is to append the tag at the end, not prepend it. This way you can start sending your ciphertext when some of it is produced and don't have to wait until the encryption (and tag production) is over. (The decrypting side still has to wait, though.) – Paŭlo Ebermann Jul 29 '13 at 18:25
@PaŭloEbermann there is very little reason not to decrypt immediately when the ciphertext is received. As GCM uses CTR mode underneath, there is no such thing as a padding oracle attack. The only thing you definitely should not do is trust (and therefore use) the plaintext before the authentication has taken place. – Maarten Bodewes Jul 29 '13 at 23:00
up vote 8 down vote accepted

The GCM authentication tag doesn't need to be encrypted. Just attach it to the ciphertext in the clear.

A very quick intuitive justification:

  • It's an authentication tag derived from the ciphertext, it doesn't contain any sensitive information itself.

  • The security of the GCM model assumes the tag is left in the open. (The GCM spec, SP 800-38D, shows the auth tag output in the clear, see section 7.1.)

share|improve this answer
Thank you. I suspected as much, but couldn't find any references that were explicit about transmitting the tag in the open. – Isaac Jul 29 '13 at 15:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.