I have written some code to do AES in GCM. I currently manually append the tag property to the ciphertext, is this the proper way to communicate the authentication tag?

  • $\begingroup$ I made some major edits to your post. If you disagree with them, feel free to roll them back. The reason for making these changes is that I felt your actual question was hidden in a lot of extraneous information. Also, for the record, Crypto.SE is not a good place for posting code and asking for code reviews. Check out some of the other SE sites where that might be more appropriate. $\endgroup$ – mikeazo Jul 14 '12 at 2:33
  • $\begingroup$ Alright thanks for the answer and letting me know about the code $\endgroup$ – crawfish Jul 16 '12 at 14:13

I currently manually append the "tag" property to the ciphertext, is this the correct method of authentication?

That is a perfectly acceptable method. In the end, there needs to be some protocol which tells the other party where the ciphertext is and where the authentication tag is. In your case, the other party knows that the last 128 bits of the message contains the authentication tag.

  • 1
    $\begingroup$ Perhaps more future-proof is to prepend the tag, since it's of a fixed width. I generally prefer to keep fixed-width fields in front, protocol-wise, if there's a variable length field. $\endgroup$ – Stephen Touset Mar 11 '13 at 21:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.