0
$\begingroup$

I have been playing with AES256-GCM in NodeJS crypto library and it shows that the original message can be decrypted without caring about the auth tag.

So can a non-tag verified decryption be secure? Only send the ciphertext+iv to the attaker and assuming he/she knows the ecryption method(in an open source github)?

Update: Eg: Let's say in my open source with OFFLINE CLIENT side encryption, even when tag is involved in the decryption it will still be CTR only equivalent in term of security?

Since the attacker can just download that open source and build the app without the tag validation step in the source code. Assuming that the attacker get access the other users's ciphertext+iv.

I thought the GCM enhances the ciphertext security not just authencity.

Improve this question
$\endgroup$
8
  • 1
    $\begingroup$ Can we call this duplicate of this What are the rules for using AES-GCM correctly? $\endgroup$
    – kelalaka
    Commented Sep 1, 2022 at 17:49
  • 1
    $\begingroup$ If you don't use an authentication tag, an attacker can modify the ciphertext and nonce without you knowing. That's extremely bad, hence the need for authentication tags. $\endgroup$
    – samuel-lucas6
    Commented Sep 1, 2022 at 18:01
  • $\begingroup$ @samuel-lucas6 does that mean he/she will modify the ciphertext and nonce on his/her own custom software? $\endgroup$
    – Kim Mỹ
    Commented Sep 1, 2022 at 18:16
  • $\begingroup$ Update: my open source software nodejs only works offline. $\endgroup$
    – Kim Mỹ
    Commented Sep 1, 2022 at 18:20
  • $\begingroup$ What is really your attack model? You should define it precisely. If there is no tag, AES-GCM is almost pure CTR mode and vulnerable to bit flipping attacks $\endgroup$
    – kelalaka
    Commented Sep 1, 2022 at 19:36

2 Answers 2

Reset to default
2
$\begingroup$

So can a non-tag verified decryption be secure? Only send the ciphertext+iv to the attacker and assuming he/she knows the encryption method (in an open source github)?

Why would an attacker benefit from getting less information? Normal GCM depends on CTR mode to keep the message secure: the ciphertext without the authentication tag is CTR mode. The only difference may be the nonce handling.

Update: Eg: Let's say in my open source with OFFLINE CLIENT side encryption, even when tag is involved in the decryption it will still be CTR only equivalent in term of security?

Well no, integrity and authenticity bring important benefits, and they are definitely part of the security equation. They disallow an attacker to change ciphertext and therefore the decrypted plaintext.

This may even influence the confidentiality of the ciphertext, as plaintext oracles are certainly a thing.

Imagine that you want to communicate the value 0, 1 or 2 to another party. You are smart and encode these in two bits (otherwise you'd immediately show information to an attacker: 1 bit encoding would mean 0 or 1, and two bit encoding would mean 2). So you encrypt these values as 00, 01 or 10 respectively.

Now the attacker flips the least significant bit, and notices that the receiving system generates an internal error: the system didn't expect 11 to be sent. From this information the attacker can directly assume that the most significant bit was a 1, thus the value that was sent must have been 2. The only requirement is that the error is noticeable one way or another.

So we have seen that yes, authenticated ciphertext are more secure - when used correctly.

In the unlikely event that the attacker can break CTR then the confidentiality of the messages is lost, regardless if GCM is used or not.

Improve this answer
$\endgroup$
5
  • $\begingroup$ I think what Kim is missing is that an attacker creating their own version of the software which just uses AES-CTR instead of checking the tags doesn't allow them to do anything to other people's data. The users of the software will be using the official version, which has authentication. $\endgroup$
    – samuel-lucas6
    Commented Sep 2, 2022 at 7:45
  • $\begingroup$ @samuel-lucas6 Does that mean with offline encryption authencity and integrity are just useless & unnecessary step? And instead of using GCM or Poly1305, I can just use raw CTR mode and warn people to download from authentic sources? $\endgroup$
    – Kim Mỹ
    Commented Sep 2, 2022 at 11:19
  • 1
    $\begingroup$ @KimMỹ No, it means the complete opposite. It's still important offline. If an attacker modifies a ciphertext, the person who goes to decrypt it will know it's been modified. Without an authentication tag, they won't and could end up decrypting anything rather than what they originally encrypted. $\endgroup$
    – samuel-lucas6
    Commented Sep 2, 2022 at 11:23
  • $\begingroup$ Another thing is, the attacker could just drive users to download his/her software versions. So instead of using GCM or Poly1305 which is more complicated and slower, I can just use raw CTR mode and warn people to download from authentic sources? Is it better? $\endgroup$
    – Kim Mỹ
    Commented Sep 2, 2022 at 11:25
  • 1
    $\begingroup$ @KimMỹ No, please listen to me. You should not just use CTR, and those are not really 'more complicated and slower'. If that sort of thing was secure, why would anybody bother with AEAD modes or Encrypt-then-MAC? That threat model is ridiculous. If an attacker can get users to download their software, they can also steal people's keys, passwords, infect their machine, steal account credentials, etc. You shouldn't worry about that when creating a piece of software as there's nothing you can do about it. You need to worry about securing your software, and that involves using tags. $\endgroup$
    – samuel-lucas6
    Commented Sep 2, 2022 at 12:31
0
$\begingroup$

Auth-tag is short for Authentication tag and it is needed for authentication.

If you omit it you are essentially doing AES-CTR. Which provides secrecy but no authentication.

If you have the key you can still decrypt the message and retrieve the plain text without the auth-tag. However messages may have been modified by an attacker.

CTR encryption is especially malleable, an attacker can take an encrypted message and xor it with anything he wants to create an equivalent modification to the secret plain text. In GCM validating the auth tag prevents such attacks.

Obviously removing information and specifically the auth tag can't hurt secrecy.

Why would you want to remove the auth tag, It's fairly cheap to validate and prevents real attacks.

Improve this answer
$\endgroup$
2
  • $\begingroup$ I mean in an open source with OFFLINE CLIENT side encryption, even when tag is involved in the decryption it will still be CTR only equivalent in term of security? Since the attacker can just download that open source and build the app without the tag validation step in the source code. Assuming that the attacker gets access the other users's ciphertext+iv. I thought the tag enhances the ciphertext security not just authencity. $\endgroup$
    – Kim Mỹ
    Commented Sep 1, 2022 at 20:19
  • 1
    $\begingroup$ "Obviously removing information and specifically the auth tag can't hurt secrecy." Yes, it can, plaintext oracle attacks. $\endgroup$
    – Maarten Bodewes ♦
    Commented Sep 1, 2022 at 22:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.