Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
I've used AES-128 in CTR mode in the past and using the same key but different IVs for each file, I wrote the IV to the first 16 bytes. Is it safe to do so with the nonces used in AES-256 GCM? I'm using the word nonce here because that's what is declared in the Sodium library.
Are the uses for IVs and nonces exactly the same?
Also, is there any use in providing additional authenticated data? Should I keep it NULL?
The IV of encryption schemes can be made public without damaging the security of the encryption, so there shouldn't be any issues with prepending it to the encrypted file.
The difference between IVs and Nonces was already explained by @SEJPM in the comments. Note that in the case of GCM, you do need to make sure that you do not re-use the IV with the same encryption key, as AES-GCM works (I'm simplifying here) by using the IV as a counter and encrypting successive counter values to generate a key stream, which is then XOR'd onto the plaintext to encrypt it (like the regular CTR-Mode). This means that if you re-use the IV and key, you will generate the same keystream again and allow more efficient attacks on the encryption (think key-reuse for one-time-pads, with the added bonus that you can also create forged messages that will pass the authenticity check of GCM, as @SEJPM points out in the comments).
You only need to add Additional Authenticated Data (AAD) if you have additional data you want to verify. An example would be to add the filename of the encrypted file as AAD if you want to be sure that the file cannot be renamed and still be decrypted. But this is highly situational, and you definitely don't need to use it.
