# programming a sniffer for AES GCM with gcrypt

I want to write a sniffer that can read AES-GCM communication using the gcrypt lib I can see in the manual that for encryption there is an additional 2 methods (for AEAD) but what about decryption ? what need to do for decryption for AEAD ciphers ? Thanks Lior

• Encryption and decryption is the same for GCM (as it uses CTR for encryption) – LightBit Dec 1 '15 at 8:56
• Are you asking how to do it with gcrypt? That's off topic here and could be asked on Stack Exchange. – otus Dec 1 '15 at 9:02
• @otus, on "Stack Exchange" is a bit misleading. I guess you meant StackOverflow. – SEJPM Dec 1 '15 at 19:59
• @SEJPM, yes, typo/brainfart. – otus Dec 1 '15 at 20:13
• I see at least three methods specifically for AEAD...getting the tag, checking the tag and indicating additional authenticated data. – Maarten Bodewes Dec 2 '15 at 0:59

You need to call gcry_cipher_authenticate if you have additional authenticated data (data also authenticated that is not encrypted and - in this case after decryption of the ciphertext, excluding authentication tag - you should call gcry_cipher_checktag with the authentication tag. It's wise and possibly required to call gcry_cipher_authenticate before decryption of any data.