Does AAD make GCM encryption more secure?

Question

Does additional authenticated data (AAD) make AES GCM encryption more secure? What if we drop AAD in AES-GCM 256? If we drop it, how will it make the encryption less secure?

Answer 1

In general the AAD itself is not required or won't change the security of the GCM mode of operation itself.

It may however directly influence the security of the protocol in which GCM is deployed. For instance, you may have specific configurable parameters outside the ciphertext itself.

These parameters may very well include:

• version number of the protocol
• message specific nonces
• addresses of recipient(s)

If you don't include these in the AAD or ciphertext then those parameters won't be validated by verification of the authentication tag. This means that attackers can simply change them. For instance, an attacker may try and switch to a previous, less secure protocol number.

You don't need to include the GCM nonce (the IV) itself in the AAD by the way; the nonce is already included in the calculation of the authentication tag.

Obviously if you allow the parameters to directly influence the GCM mode of operation itself then validating the authentication tag may be too late; you're better off to verify or set them beforehand for maximum security.

Answer 2

AAD has nothing to do with making it "more secure". The aim of AAD is to attach information to the ciphertext that is not encrypted, but is bound to the ciphertext in the sense that it cannot be changed or separated. (Conceptually, the MAC is computed over the AAD and the ciphertext together.)