3
$\begingroup$

This question already has an answer here:

I've used AES-128 in CTR mode in the past and using the same key but different IVs for each file, I wrote the IV to the first 16 bytes. Is it safe to do so with the nonces used in AES-256 GCM? I'm using the word nonce here because that's what is declared in the Sodium library.

Are the uses for IVs and nonces exactly the same?

Also, is there any use in providing additional authenticated data? Should I keep it NULL?

$\endgroup$

marked as duplicate by otus, poncho, e-sushi Mar 24 '16 at 1:57

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • $\begingroup$ By convention: A nonce is a number only used once and an IV is an unpredictable (random) string. AAD: you should provide any data that you want to be associated but not encrypted here (like KDF parameters) $\endgroup$ – SEJPM Mar 19 '16 at 9:35
4
$\begingroup$

The IV of encryption schemes can be made public without damaging the security of the encryption, so there shouldn't be any issues with prepending it to the encrypted file.

The difference between IVs and Nonces was already explained by @SEJPM in the comments. Note that in the case of GCM, you do need to make sure that you do not re-use the IV with the same encryption key, as AES-GCM works (I'm simplifying here) by using the IV as a counter and encrypting successive counter values to generate a key stream, which is then XOR'd onto the plaintext to encrypt it (like the regular CTR-Mode). This means that if you re-use the IV and key, you will generate the same keystream again and allow more efficient attacks on the encryption (think key-reuse for one-time-pads, with the added bonus that you can also create forged messages that will pass the authenticity check of GCM, as @SEJPM points out in the comments).

You only need to add Additional Authenticated Data (AAD) if you have additional data you want to verify. An example would be to add the filename of the encrypted file as AAD if you want to be sure that the file cannot be renamed and still be decrypted. But this is highly situational, and you definitely don't need to use it.

$\endgroup$
  • $\begingroup$ Please substitute "IV" with "nonce". If you reuse a nonce with GCM you are also able to make arbitrary forgeries, i.e. construct ciphertexts that look valid but aren't. $\endgroup$ – SEJPM Mar 19 '16 at 14:12
  • 1
    $\begingroup$ It's called IV in the official specifications, so while it should be used like a nonce, I'm using IV for consistency. $\endgroup$ – malexmave Mar 19 '16 at 14:17

Not the answer you're looking for? Browse other questions tagged or ask your own question.