I am looking to encrypt a piece of data using AES-GCM with a full 16-byte GCM Tag and send it over the network using UDP. Is it safe to assume using the AEAD nature of AES-GCM that performing authenticated decryption will prevent ciphertext length extension attacks with an implicit length?
In short, I want to determine the length of the ciphertext by looking at the UDP packet size and removing my app specific headers. This avoids the need for an explicit ciphertext length. Explicit length would increase the per-packet overhead, and every byte counts on the network.
Can I derive the length or must I specify it explicitly?
Section 5.3 (Page 44) of https://eprint.iacr.org/2013/144.pdf suggests while the GCM Tag includes length, it is still vulnerable to at least one weakness. But reading that, I'm not left with the impression that adding an explicit length into the AD would make a difference.
(Note: Originally asked this question on security.stackexchange.com, realised it was wrong site so re-posting here)