AES GCM Difference between the IV and the Secret Key?

Question

Below is part of AES GCM diagram. However, it only shows the behavior of the IV/counter.

The GCM specification examples state both an IV and a Secret Key as two inputs.

Can someone please explain where both are used?

Is the 96 bit IV expanded to 128 bits, incremented (most-significant byte?) and used to create the AES Key Expansion?

And the Secret Key is passed (with the Key Expansion) to E_k for encryption?

poncho · Accepted Answer · 2023-02-15 13:57:57Z

2

And the Secret Key is passed (with the Key Expansion) to E_k for encryption?

Yes, the key is given to the block cipher - it is indeed the $k$ in $E_k$

answered Feb 15 at 13:57

poncho

145k11 gold badges228 silver badges357 bronze badges

$\begingroup$ Awesome, thanks! And am I right the 96 bit IV is expanded to 128 bits at the beginning and then the most significant byte is incremented, before then being used to generate the expansion? $\endgroup$
– user997112
Feb 15 at 14:03
2

$\begingroup$ @user997112: actually, with 96 bit IVs (GCM supports other IV sizes; those are rarely used), the IV is used as the top 96 bits (counting bits in bigendian order) of the AES input; the lower 32 bits is a counter (which is 1 for generating the mask for the tag; 2 for encrypting the first plaintext block; 3 for the second, etc). Hence, it is the least significant byte which is incremented (again, counting 'least' in bigendian order) $\endgroup$
– poncho
Feb 15 at 14:31
$\begingroup$ Lets say our IV is all zeros. This value is only used for the hashing (as you mentioned). The IV is then incremented. Does iv[0] contain 1, or is it iv[15]? $\endgroup$
– user997112
Feb 15 at 14:57
$\begingroup$ @user997112: well, for IV - 96 0 bits, the value given to AES to generate the tag mask has iv as all zeros except iv[15] = 1. $\endgroup$
– poncho
Feb 15 at 16:15
$\begingroup$ I've asked the problem in a new question, if you could take a glance: crypto.stackexchange.com/questions/104243/… $\endgroup$
– user997112
Feb 15 at 18:49

Add a comment |

1 Answer 1