Using GMAC for Authentication without encrypting the message

Question

I am pretty new to cryptography and have a sample of GCM mode of operation for AES.
PFB the code

    Cipher c = Cipher.getInstance ("AES/GCM/NoPadding");
    final int blockSize = 96;//c.getBlockSize();
    final byte[] ivData = new byte[blockSize];
    System.out.println("IV :- "+new String(ivData) );
    final SecureRandom rnd = SecureRandom.getInstance("SHA1PRNG");
    rnd.nextBytes(ivData);
    System.out.println("IV :- "+new String(ivData) );
    /**
     * 
     */
    GCMParameterSpec params = new GCMParameterSpec(blockSize , ivData);
    SecureRandom sr = new SecureRandom();
    byte[] aesKey = MessageDigest.getInstance("MD5").digest(
            "som3C0o7p@s5".getBytes());
    byte[] ciphertext;
    byte[] head = "Header information".getBytes();
    byte[] data = "Data to encrypt".getBytes();
    sr.nextBytes(aesKey);
    SecretKeySpec sks = new SecretKeySpec(aesKey, "AES");
    c.init(Cipher.ENCRYPT_MODE, sks, params);
    c.updateAAD(head);
    ciphertext = c.doFinal(data);
    System.out.println("done   "+ new String(ciphertext));

    c.init(Cipher.DECRYPT_MODE, sks, params);
    c.updateAAD(head);

    ciphertext = c.doFinal(ciphertext);
    System.out.println("done   "+ new String(ciphertext));

But I need to do Authentication using GMAC. How do I do authentication using GMAC without encrypting/decrypting? Any pointers or suggestions will be very helpful.

Answer 1

GMAC is quite simply GCM mode where all data is supplied as AAD (or additional authenticated data), or as NIST SP 800-38D puts it:

If the GCM input is restricted to data that is not to be encrypted, the resulting specialization of GCM, called GMAC, is simply an authentication mode on the input data.

If you don't have access to a cryptographic provider that supports GMAC directly (e.g. Bouncy Castle provides a AES-GMAC JCE Mac) you can simply use any AES/GCM implementation by providing all data as AAD, and an empty message for encryption.

e.g. adapting your example to do GMAC only:

... as for AES/GCM ...
c.updateAAD(head);
c.updateAAD(data);
byte[] mac = c.doFinal();
System.out.println("GMAC: " + SomeHexEncoder.encode(mac));

If you need to be certain you're getting it right, the GCM/GMAC test vectors from the NIST CAVP page can be used (everything with a PTlen = 0 is a GMAC test vector).

Answer 2

You can supply all your data as aad and keep the plain text with 0 length. Below code is in c# using bounty castle library. If the data is null, it will just generate the authentication tag without encrypting.

public static class Security
{
    public static byte[] GCMEncrypt(byte[] data, byte[] key, byte[] iv, byte[] aad, out byte[] authTag)
    {
        authTag = new byte[12];
        //Non-secret Payload Optional
        aad = aad ?? new byte[] { };

        var cipher = new GcmBlockCipher(new AesFastEngine());
        var parameters = new AeadParameters(new KeyParameter(key), 96, iv, aad);
        cipher.Init(true, parameters);
        if(data == null)
        {

            var cipherText1 = new byte[cipher.GetOutputSize(0)];
            cipher.DoFinal(cipherText1, 0);
            authTag = cipherText1;
            return authTag;
        }

        //Generate Cipher Text With Auth Tag
        var cipherText = new byte[cipher.GetOutputSize(data.Length)];
        var len = cipher.ProcessBytes(data, 0, data.Length, cipherText, 0);
        cipher.DoFinal(cipherText, len);

        byte[] ret = new byte[data.Length];

        Array.Copy(cipherText, ret, data.Length);
        if(cipherText.Length > data.Length)
        {
            Array.Copy(cipherText, data.Length, authTag, 0, cipherText.Length - data.Length);
        }

        return ret;
    }
}