0
$\begingroup$

When creating a SealedBox, one of the parameters which needs to be passed is an authentication tag:

https://developer.apple.com/documentation/cryptokit/aes/gcm/sealedbox/init(nonce:ciphertext:tag:)

I have 2 questions about this:

  1. What should this authentication tag be? I have seen quite a few examples online where they simply pass an empty data buffer: Data(). For example here:

https://stackoverflow.com/questions/75916728/getting-authentcationfailure-with-nonce-and-tag-using-cryptokit

they say: "You should not provide a pre determined tag while encrypting."

Is passing an empty data buffer okay from a security point of view?

  1. If I pass something else - lets say some random data - as the authentication tag, how would the person decrypting it know about this tag? Can it be safely sent publicly? How should both parties come up with the same authentication tag?

EDIT:

Here's my encryptedData function which has an authenticating parameter.

func encryptedData(decryptedData : Data, key : SymmetricKey) throws -> Data {
    let sealedMessage = try AES.GCM.seal(decryptedData, using: key, nonce: AES.GCM.Nonce(), authenticating: Data())
    
    guard let encryptedData = sealedMessage.combined else {
        throw "Error in sealedMessage"
    }
    
    return encryptedData
}
$\endgroup$
11
  • 1
    $\begingroup$ The authentication tag is an output in an AEAD scheme that's normally appended to the ciphertext. You send the ciphertext concatenated with the authentication tag. When decryption is performed, the authentication tag will be verified prior to decrypting the ciphertext to check for tampering. Now I don't know anything about Apple CryptoKit, but it looks like you shouldn't be using the Init function but the Seal function for encryption and Open for decryption, as stated here. Seal produces a sealed box. $\endgroup$ Feb 1 at 22:47
  • 1
    $\begingroup$ The authenticatedData is the AD part of Authenticated Encrypted with Associated Data (AEAD). Again a stupid naming by Apple people. Look at this picture and search for Auth Data 1. This data is not encrypted however authenticated. Can be used in protocols to clarify the data without decryption. $\endgroup$
    – kelalaka
    Feb 1 at 23:25
  • 1
    $\begingroup$ @kelalaka so, if I understand correctly, the authenticationData is actually some additional data which can be authenticated? Can I use it to pass additional information such as "chunk number" and "total number of chunks" when encrypting large files by breaking into smaller chunks? That way, can I use it to ensure order and size of the large file? $\endgroup$ Feb 2 at 0:00
  • 1
    $\begingroup$ Yes, that would be one way, as long as nonce / key combination is not reused of course. The nonce does need to change for each chunk anyway otherwise the ciphertext will leak information (CTR may create a many time OTP). $\endgroup$
    – Maarten Bodewes
    Feb 2 at 1:38
  • 1
    $\begingroup$ Different keys could be derived for each file. $\endgroup$
    – Maarten Bodewes
    Feb 2 at 17:57

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.