Tag Info

It is indeed safe to send it along with the ciphertext; the attacker can't learn anything from it (other than possibly how many packets has been generated so far, if you use a counter to generate the IVs), and if the attacker modifies the IV, the resulting message will fail to decrypt (with high probability). Existing protocols that can use GCM (TLS, IPSec) ...

First of all, a terminology nit: please don't say "a One-time-pad generated by a CSPRNG"; a one-time pad must, by definition, be generated randomly, and an important part of its security proof is that it was generated randomly (and so an attacker cannot disqualify any potential pad, even if that attacker had infinite computational resources). ...

If you use a CSPRNG to generate the pad, you're not using a one-time-pad anymore by definition since the pad is no longer random, so the question as stated is incorrect with respect to terminology. The advantage of using stream ciphers is that you no longer have the key distribution problem the OTP has, since your key is now only a few dozen bits long, and ...

If you go through the math, it appears that exactly the expected amount of ciphertext expansion is happening. Here's what's happening: The GCM takes the plaintext as a byte string of size N, and generates a ciphertext which is a byte string of size N+28, where 12 of the 28 is the nonce, and the other 16 is the authentication tag. Then, that octet string ...

You got some notation wrong. There is no algorithm like "AES-GCM-SHA-256". AES is a block cipher, i.e. a pseudorandom permutation of 128-bit blocks. It itself only allows encryption for messages of size 128 bits (= 16 bytes), with a limited security guarantee. When you mean "encrypt the data using AES", you actually mean "use AES with some mode of ...

GCM mode already incorporates any params that could affect the outcome of the decryption. The associated authenticated data is there to allow you to rely on context for your decryption. For example, say you are encrypting some records associated with a user. You may want to include the user's database ID as the authenticated data. If a user found a way to ...

I currently manually append the "tag" property to the ciphertext, is this the correct method of authentication? That is a perfectly acceptable method. In the end, there needs to be some protocol which tells the other party where the ciphertext is and where the authentication tag is. In your case, the other party knows that the last 128 bits of the ...

Well, I'm unfamiliar with this specific C# library, and so I can't answer questions about its API. I could guess, but I suspect you want something better than that. However, I can answer generic GCM questions. 1a. What does the AAD consist of? Well, AAD is another service that GCM provides. When encrypting messages, it is actually quite common to want ...

You certainly could keep the AAD secret; however, for GCM, it wouldn't provide any additional security beyond what the secret key already provides; for CCM, it does still provide some limited authentication protection (but probably not enough). The bottom line: if you can't trust that your key is secret, well, keeping the AAD secret (or have a secret ...

Your options should really be either using GCM mode, or using a non-authenticated mode (such as CBC) and calculating the HMAC (with something like HMAC-SHA256) post-encryption. Using an asymmetrical encryption scheme such as RSA in this context is not very efficient or appropriate. GCM is a good option as it combines encryption and integrity in one ...

It is not possible to get the same secret every time. You get a new random shared secret reach time. The protocol (for a known generator $g \in G$ where $G$ and $g$ are chosen correctly) is Alice computes $A=g^a$ and sends $A$ to Bob. $$Alice \ g^a\xrightarrow{A} Bob$$ Then Bob computes $B=A^b$ and sends it to Alice. $$Alice \xleftarrow{B} B=A^b\ Bob$$ ...

Yes, the nonce will be used with a counter appended in order to generate the CTR mode keystream. It will also be used as an input to GHASH: which is a polynomial MAC used to authenticate the data. The nonce itself does not have to be random, it can be a counter. But it absolutely must be unique for each message encrypted with the same key. Using GCM on two ...

It's much more secure to use AES (or some other well-understood cipher) in a well-described mode than to go construct some random number generator and pretend that it's a one-time pad. It's better not to lie to yourself. If you use AES in counter mode, you're effectively using AES as a PRNG and then that as a pad, since you XOR the AES onto the plaintext. ...

Thats a Pseudo-One-Time Pad. A good CSPRNG need have only one attribute. Its output must be unpredictable to an attacker. And thats it. If it is truly unpredictable, then it must be random (otherwise it could be predicted). Note that many PRNG are completely predictable - for some simple schemes given a few bytes of output, the rest can be 100% predicted. ...