# How to supply the GCM authentication tag to the OpenSSL command line tools?

I'm using AES-256-GCM for authenticated encryption. In order to decrypt, the ruby OpenSSL library requires an auth_tag parameter (in addition to the key and iv). This, according to the ruby docs, is because authenticated encryption is only supported with associated data (AEAD).

How can I use this auth_tag to decrypt? The node.js crypto library doesn't have an option for it, so I'm trying to use the openssl command line tool. However, looking at the docs, even that doesn't have an option for supplying the authetication tag.

-
The auth_tag parameter actually has nothing to do with associated data; that's what the (confusingly similar-named) auth_data parameter is for. –  Ilmari Karonen Aug 9 '13 at 18:06

## 1 Answer

Here's a NodeJS AES-GCM module. Or alternatively, you can use the OpenSSL library to write your own GCM decryption code, here's a quick tutorial.

The OpenSSL utility has historically not supported GCM encryption/decryption via command line parameters, likely due to the auth tag issue. I don't think that anything has changed since then, so you may want to take another approach.

-
Thanks. If the utility doesn't support it, I'd rather just MAC my AES-CBC ciphertext, rather than use GCM. –  LanguagesNamedAfterCofee Aug 9 '13 at 17:24