0
$\begingroup$

This answer recommends authenticating the IV with HMAC when using AES and then HMAC.

Since AES-GCM provides authentication too, should the external nonce passed to GCM be authenticated separately when passing over network? If not, why not? If it should be what is the recommended way to do it?

$\endgroup$
3
$\begingroup$

Should the external nonce passed to GCM be authenticated separately when passing over network?

No, that is not necessary; it is implicitly authenticated by GCM itself, pretty much as the AAD is also authenticated. That is, if someone in the middle modifies the nonce, then that will alter the authentication tag that the decryptor computes as a part of the GCM decryption process (and alters it in a way that cannot be predicted by someone without the key). Because the tag will not match the authentication tag that comes with the encrypted packet, the altered packet will be rejected.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.