I want to write a sniffer that can read AES-GCM communication using the gcrypt lib I can see in the manual that for encryption there is an additional 2 methods (for AEAD) but what about decryption ? what need to do for decryption for AEAD ciphers ? Thanks Lior
You need to call
gcry_cipher_authenticate if you have additional authenticated data (data also authenticated that is not encrypted and - in this case after decryption of the ciphertext, excluding authentication tag - you should call
gcry_cipher_checktag with the authentication tag. It's wise and possibly required to call
gcry_cipher_authenticate before decryption of any data.
You should not rely on the correctness of the decrypted data before verifying (checking) the authentication tag. Note that the handling of the authentication tag differs from one library to the other (and this library actually takes the sensible route if you ask me: fully online decryption and explicit tag verification).