AES GCM iv/nonce length under 12 bytes in java [duplicate]

Question

I'm developping an Swift app that communicate with a Java legacy backend using AES GCM, my biggest problem is that Java let you use a 8 bytes iv/nonce (and the legacy code is written with 8 bytes nonce). You can't do that in swift, it result in error. I can't find in javadoc what happen to nonce too short, i guess they transform it (hash maybe ?) Do you have any idea besides upgrading the legacy code ?

Answer 1

Does the legacy code convert the 8 byte nonce into a 12 byte nonce (say, by concatenating 32 fixed bits)? Or, does it use it directly into GCM (computing the GHASH of the 8 byte nonce)?

If the legacy code converts the 8 byte nonce into a 12 byte nonce, it's pretty obvious (just have the Swift app convert the 8 byte nonce in the same way).

If it uses the little-used facility of GCM to handle nonce sizes other than 12 bytes, well, there is no way to generate a 12 byte nonce that will do the same thing.

Here's why: in GCM, the nonce is used to select the initial 16 byte counter. With a 12 byte nonce, it generates that counter by taking the 12 bytes, and sticking fixed 00 00 00 01 bytes at the end; that is, whenever you use a 12 byte nonce, the last 4 bytes of the counter will always be those values.

On the other hand, if you use any other nonce size (say, 8 bytes), GCM sends the IV (and its length) through an internal GHASH operation, which generates a 16 byte value. For an 8 byte nonce, this GHASH operation consists of appending the 8 bytes 00 00 00 00 00 00 00 40 to the nonce, and then multiplying the result (in $GF(2^{128}$) with the secret value $H$. Now, those 16 bytes will likely not have a 00 00 00 01 pattern at the end, and so the transform that GCM produces will likely be not representable by a 12 byte nonce.

Now, there is one dim possibility; if the legacy code were to always generate nonces that, after a GHASH, had a 00 00 00 01 pattern at the end, well, you could cobble something together. However, the effort to do that is likely more than the effort to support 12 byte nonces in the legacy code, and in addition, because GHASH is a keyed operation, you would have to be careful to not leak anything - transmitting the 8 byte nonces that work would leak, and so you would need to do something other than that.