Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
I have been learning about AES-GCM and AES in general lately and founding:
The key is the secret and both sender and receiver keep it hidden forever.
The IV and auth tag are public and sent along with the ciphertext which means they are public to the world.
So what can these give other people hints or information about the ciphertext?
The key is the secret and both sender and receiver keep it hidden forever.
Well, yes, unless you want to share it with a party you trust, of course. There can be multiple receivers of the same message. And if message confidentiality is not required anymore you could even release the key publicly.
The IV and auth tag are public and sent along with the ciphertext which means they are public to the world.
First I'd like to explain that AES-GCM takes a nonce. Most libraries that I see use treat the IV as the nonce value. I'll use the term "nonce" though.
Are the nonce and authentication tag public? Not necessarily. The nonce and authentication tag as assumed to be known to the adversary in the security provided by AES-GCM. However, if they are public or not depends on the use case.
It is certainly commonplace to keep the authentication tag with the ciphertext. However, this is a separate output parameter for the cipher.
If the nonce is kept with or even prefixed to the ciphertext depends much more on the protocol. It is relatively common to e.g. use a message counter or unique ID of a message as a nonce. In that case the nonce doesn't necessarily have to be included with the message.
So what can these give other people hints or information about the ciphertext?
You need the key and nonce to be able for verifying the authentication tag. This provides message integrity and authentication. Obviously you also need both of these to decrypt the message.
Note that the security of the scheme depends on the key value, not so much the nonce, which is required to make the encryption performed unique for all the values in the plaintext message.
