Cipher is GCM-AES. Is it acceptable/recommended to store the IV as AAD? Any popular examples?

  • 1
    $\begingroup$ AES-GCM already does this by default. $\endgroup$
    – SEJPM
    Nov 9 '16 at 19:08
  • $\begingroup$ @SEJPM Please explain. I was under the impression that AAD was optional. Or do you mean the IV is authenticated by the tag? $\endgroup$
    – Bondolin
    Nov 9 '16 at 19:19
  • $\begingroup$ The specification of the GCM mode mandates that you feed the IV / Nonce in as "additional associated data" (AAD). If you don't do that your implementation isn't allowed to be called "GCM". $\endgroup$
    – SEJPM
    Nov 9 '16 at 19:27
  • 3
    $\begingroup$ To clarify, the upshot is that GCM already transparently authenticates the IV as part of its internal operation. Adding it manually to the AAD does nothing extra. The point of the AAD is (typically) to add out-of-band context to the decryption process. For instance, one might use a sequence number in a protocol like TLS to detect packets that have been maliciously reordered. $\endgroup$ Nov 9 '16 at 21:13

You don't need to put the IV in the AAD (Additional Authenticated Data) as already indicated in the comments.

The GCM proposal as adopted by NIST (PDF) clearly specifies this in paragraph 2.1 Inputs and Outputs:

The IV is authenticated, and it is not necessary to include it in the AAD field.

The NIST document SP 800-38d (PDF) does not explicitly specify it, it does however contain some hints to this effect, for instance in Appendix B:

The creation of an authentication tag by the authenticated encryption function provides the mechanism whereby assurance of the authenticity of the plaintext and AAD (and IV) can be obtained upon the execution of the authenticated decryption function.

Finally, to make this a bit more general, RFC 5116 : An Interface and Algorithms for Authenticated Encryption, 2.1: Authenticated Encryption specifies the following:

The nonce is authenticated internally to the algorithm, and it is not necessary to include it in the AD input. The nonce MAY be included in P or A if it is convenient to the application.

So it is acceptable to store the IV in the AAD, but I don't see any reason to recommend it.

If I'd see the IV included in the AAD during a review I'd probably see it as an indication that the designer didn't know what he/she was doing.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.