Authenticated Encryption with Associated Data (AEAD), such as AES-GCM, is a form of encryption that has a "built-in" integrity verification. This means that if the encrypted message is modified in any way, then this will be detected (with very high probability) in the decryption process and the decryption is going to fail with an error. Additionally, we have so-called "associated data" that is not encrypted, but that still is protected by the integrity verification.

Now, I wonder: What if we leave the confidential message empty and use only "associated data"? Doesn't this come down to a MAC over the "associated data", similar to a keyed-hash (e.g. HMAC)? And, if so, is this a valid application of AEAD, such as AES-GCM function?

There is one thing that is concerning me: HMAC produces MAC of length 256-Bit or even 512-bit, when used with SHA-256 or SHA-512, which seems to be a common choice these days. Using SHA-1 with 160-bit is not considered secure anymore. But AES-GCM produces an "auth tag" with only 128-bits in size! This seems rather small, compared to the state-of-the-art secure hash functions. So, does AES-GCM as a MAC provide security comparable to HMAC (with SHA-2)?

If we use AES-GCM as a MAC function, we have to provide a secret key (just like HMAC) plus a random/unique IV for each message. HMAC doesn't have this random per-message IV. I assume that with AES-GCM we would have to return the random IV as part of the computed MAC, so that verification will later be possible. How does this effect the security of AES-GCM as a MAC?

  • $\begingroup$ With MAC usually collision resistance is unimportant hence why 128 bits is sufficient. If however an adversary gets to choose keys (different use case for an AEAD) then not only is collision resistance perhaps of importance but GMAC, poly1305 etc are insecure and HMAC is a good idea. $\endgroup$ Commented Oct 23, 2023 at 16:16
  • $\begingroup$ Why is collision resistance considered "unimportant" for MAC/AEAD sceanrio? Attacker (without secret key) cannot, normally, calculate the valid MAC (or "Auth Tag") for a modified message. But, if the attacker was able to find a collision, i.e. a message that is different but, by chance, has the same MAC (or "Auth Tag"), then that message could be swapped for the original message and the receiver would still find that the original MAC (or "Auth Tag") is matching. $\endgroup$
    – pogoya9172
    Commented Oct 24, 2023 at 9:04
  • $\begingroup$ @Gilles 'SO- stop being evil': Yes, it helps, I think. $\endgroup$
    – pogoya9172
    Commented Oct 24, 2023 at 9:11


Browse other questions tagged or ask your own question.