Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using AES-256-GCM for authenticated encryption. In order to decrypt, the ruby OpenSSL library requires an auth_tag parameter (in addition to the key and iv). This, according to the ruby docs, is because authenticated encryption is only supported with associated data (AEAD).

How can I use this auth_tag to decrypt? The node.js crypto library doesn't have an option for it, so I'm trying to use the openssl command line tool. However, looking at the docs, even that doesn't have an option for supplying the authetication tag.

share|improve this question
The auth_tag parameter actually has nothing to do with associated data; that's what the (confusingly similar-named) auth_data parameter is for. – Ilmari Karonen Aug 9 '13 at 18:06
up vote 2 down vote accepted

Here's a NodeJS AES-GCM module. Or alternatively, you can use the OpenSSL library to write your own GCM decryption code, here's a quick tutorial.

The OpenSSL utility has historically not supported GCM encryption/decryption via command line parameters, likely due to the auth tag issue. I don't think that anything has changed since then, so you may want to take another approach.

share|improve this answer
Thanks. If the utility doesn't support it, I'd rather just MAC my AES-CBC ciphertext, rather than use GCM. – LanguagesNamedAfterCofee Aug 9 '13 at 17:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.