0
$\begingroup$

I am trying to understand the AESGcm encryption and decryption and there's one field associated data in Encryption and Decryption methods.

https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.aesgcm.decrypt?view=net-7.0#system-security-cryptography-aesgcm-decrypt(system-byte()-system-byte()-system-byte()-system-byte()-system-byte())

I want to understand what's the use of these fields during Encryption and Decryption process. It doesn't seem to be present in AESCng library. Moreover it doesn't even generate the authentication tag which is generated in AESGcm. Can anybody explain these different fields in both the algorithms and their usage.

https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.aescng?view=net-7.0

Improve this question
$\endgroup$
2
  • 1
    $\begingroup$ Does the AESCng class implement GCM? In the class documents, I see the four original NIST modes (ECB, CBC, CFB, OFB), but not GCM. If it only supports the original 4 modes, they don't support AAD or authentication tag, hence it wouldn't be surprising if the class wouldn't mention them either $\endgroup$
    – poncho
    Sep 29, 2022 at 16:49
  • 2
    $\begingroup$ If the question is about what Additional Authenticated Data is, see this. If the question is about APIs, well that's rather off-topic, and a tad unclear. In particular, is the question's AESGcm the AesGcm .NET class, or AES-GCM (the operating mode for AES that AesGcm implements), or what exactly? As pointed by the above comment, it does not look like AesCng does AES-GCM. $\endgroup$
    – fgrieu ♦
    Sep 29, 2022 at 16:57

1 Answer 1

Reset to default
1
$\begingroup$

Can anybody explain these different fields in both the algorithms and their usage.

Both these fields are designed to detect it if someone in the middle tries to play games with the encrypted data. That is, if the receiver decrypts the data, GCM tries to ensure that the data he received is precisely what the sender sent.

The authentication tag is the easiest to understand; it's a complex function of the ciphertext; if the attacker generates his own ciphertext (or modifies one that was sent), we have a provably [1] low probability that the tag the attacker sent will be the tag computed by the receiver; if the tag doesn't match, the message is rejected.

The Additional Authenticated Data (AAD) is there to address a more subtle issue; what if the attacker takes a message that was sent in one context, and resend it into another. To take a fancible example, we can have:

Alice: Encrypt("Do you like ice cream") -> Bob
Alice:                 <- Encrypt("Yes") : Bob
Alice: Encrypt("Will you marry me" ) ->    Bob

If a prankster were to take Bob's first yes (to an innocuous question) and repeat it to Alice, well, Alice may think that Bob just accepted her marriage proposal.

AAD is there to frustrate such pranksters; with each GCM encryption, the AAD can be used to signify the context that the encryption was sent. During encryption, Alice encrypts with the AAD that corresponds to the context she means; Bob decrypts with the AAD that corresponds to the context he meant. If Bob receives the message in the wrong context (for example, the answer to the wrong question), the tags won't match, and the message will be rejected.

The AAD can be any string that identifies the encryption; it might be just a serial number (e.g. "1" for the first message, "2" for the second); in my whimsical example, the AAD for the answers might just be the question the answer was to.

And, if you're using GCM in such a way where you are only encrypting only a single message with a key (e.g. as the symmetric part of IES), you can leave it out (because you don't need the security service that it provides).

[1]: Any such provability statement makes assumptions: the ones here are a) the attacker doesn't know the AES key, b) AES isn't broken, c) the attacker hasn't seen two different valid ciphertexts messages with the same nonce

Improve this answer
$\endgroup$
4
  • $\begingroup$ What you are saying is that AAD could be just any string and doesn't really play any role in the encryption. For example you gave Alice : Encrypt(will you marry me), AAD: MarriageProposal -> Bob Alice:Encrypt (Do you like icecream), AAD: Random chat -> Bob Correct me if i am wrong. $\endgroup$
    – Captain_Levi
    Sep 29, 2022 at 17:13
  • $\begingroup$ @Captain_Levi: actually, it does play a role in the encryption (specifically, in the creation of the authentication tag). On the other hand, yes, AAD could be just any string (I believe there's a length limit, but it's ridiculously large...) $\endgroup$
    – poncho
    Sep 29, 2022 at 17:20
  • $\begingroup$ @Captain_Levi: as for your example, yes, it would work - however the decryptor needs to have the AAD in hand before he decrypts. Hence, the tags MarriageProposal and Random chat would need to be sent along with the ciphertext. Depending on our security goals, we might not want to leak that. However, there are other ways to formulate AADs $\endgroup$
    – poncho
    Sep 29, 2022 at 17:30
  • $\begingroup$ any algorithm followed to generate the authentication tag on basis of AAD? $\endgroup$
    – Captain_Levi
    Sep 29, 2022 at 18:14

Not the answer you're looking for? Browse other questions tagged or ask your own question.