0
$\begingroup$

Below is part of AES GCM diagram. However, it only shows the behavior of the IV/counter.

The GCM specification examples state both an IV and a Secret Key as two inputs.

Can someone please explain where both are used?

Is the 96 bit IV expanded to 128 bits, incremented (most-significant byte?) and used to create the AES Key Expansion?

And the Secret Key is passed (with the Key Expansion) to E_k for encryption?

enter image description here

$\endgroup$

1 Answer 1

2
$\begingroup$

And the Secret Key is passed (with the Key Expansion) to E_k for encryption?

Yes, the key is given to the block cipher - it is indeed the $k$ in $E_k$

$\endgroup$
5
  • $\begingroup$ Awesome, thanks! And am I right the 96 bit IV is expanded to 128 bits at the beginning and then the most significant byte is incremented, before then being used to generate the expansion? $\endgroup$
    – user997112
    Feb 15, 2023 at 14:03
  • 2
    $\begingroup$ @user997112: actually, with 96 bit IVs (GCM supports other IV sizes; those are rarely used), the IV is used as the top 96 bits (counting bits in bigendian order) of the AES input; the lower 32 bits is a counter (which is 1 for generating the mask for the tag; 2 for encrypting the first plaintext block; 3 for the second, etc). Hence, it is the least significant byte which is incremented (again, counting 'least' in bigendian order) $\endgroup$
    – poncho
    Feb 15, 2023 at 14:31
  • $\begingroup$ Lets say our IV is all zeros. This value is only used for the hashing (as you mentioned). The IV is then incremented. Does iv[0] contain 1, or is it iv[15]? $\endgroup$
    – user997112
    Feb 15, 2023 at 14:57
  • $\begingroup$ @user997112: well, for IV - 96 0 bits, the value given to AES to generate the tag mask has iv as all zeros except iv[15] = 1. $\endgroup$
    – poncho
    Feb 15, 2023 at 16:15
  • $\begingroup$ I've asked the problem in a new question, if you could take a glance: crypto.stackexchange.com/questions/104243/… $\endgroup$
    – user997112
    Feb 15, 2023 at 18:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.