I have written some code to do AES in GCM. I currently manually append the tag property to the ciphertext, is this the proper way to communicate the authentication tag?

  • $\begingroup$ I made some major edits to your post. If you disagree with them, feel free to roll them back. The reason for making these changes is that I felt your actual question was hidden in a lot of extraneous information. Also, for the record, Crypto.SE is not a good place for posting code and asking for code reviews. Check out some of the other SE sites where that might be more appropriate. $\endgroup$
    – mikeazo
    Jul 14, 2012 at 2:33
  • $\begingroup$ Alright thanks for the answer and letting me know about the code $\endgroup$
    – crawfish
    Jul 16, 2012 at 14:13

1 Answer 1


I currently manually append the "tag" property to the ciphertext, is this the correct method of authentication?

That is a perfectly acceptable method. In the end, there needs to be some protocol which tells the other party where the ciphertext is and where the authentication tag is. In your case, the other party knows that the last 128 bits of the message contains the authentication tag.

  • 1
    $\begingroup$ Perhaps more future-proof is to prepend the tag, since it's of a fixed width. I generally prefer to keep fixed-width fields in front, protocol-wise, if there's a variable length field. $\endgroup$ Mar 11, 2013 at 21:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.