In the introduction of NIST Special Publication 800-38D is said that:

GCM provides assurance of the confidentiality of data using a variation of the Counter mode of operation for encryption. GCM provides assurance of the authenticity of the confidential data (up to about 64 gigabytes per invocation) using a universal hash function that is defined over a binary Galois (i.e., finite) field. GCM can also provide authentication assurance for additional data (of practically unlimited length per invocation) that is not encrypted.

As a block cipher GCM guarantees the confidentiality of data, but what does it mean that it assures its authenticity? And what is exactly the authentication assurance for the unencrypted additional data?

I believe that data authenticity may correspond to its integrity, i.e. the absence of tamperings, while I'm not sure of the meaning of the authentication for the additional data.

  • $\begingroup$ GCM is essentially combining a Message authentication code (to ensure integrity of message and additional data) and encryption (to ensure confidentiality of the message) $\endgroup$ – CodesInChaos Dec 6 '16 at 17:26
  • $\begingroup$ So the authentication of the additional data corresponds only to the property that it is received in the same condition that it was sent out, without modifications? $\endgroup$ – M-elman Dec 6 '16 at 17:34

Authenticity of the data assures that the data in question was created or modified by an authorized party (a key holder). Without authenticity, anyone could present an arbitrary block of data as a valid ciphertext. Though it is overwhelmingly likely that decrypting such a block will result in a garbage plaintext, it can still disrupt the application that is attempting to use the data. This is different from integrity, in that integrity assures you that a given piece of data has not been modified (either by an unauthorized party or by more mundane sources of data corruption such as bad hardware/line noise/cosmic rays/etc).

So the authentication of the additional data corresponds only to the property that it is received in the same condition that it was sent out, without modifications?

Technically, integrity is what guarantees that the data was received in the same condition as it was sent out. Authenticity assures that the data originated from an authorized party.

Integrity can be seen as a subset of Authenticity. For example, you can obtain integrity by hashing a message. This does not provide authenticity though. For that, you require a MAC.

| improve this answer | |
  • $\begingroup$ And the MAC corresponds to the tag provided by GCM in this case, am I right? $\endgroup$ – M-elman Dec 6 '16 at 17:59
  • $\begingroup$ @M-elman Yes, the "tag" produced by GCM is a message authentication code. $\endgroup$ – Ella Rose Dec 6 '16 at 18:03
  • $\begingroup$ However, that's doesn't provide a signature (and so the non-repudiation) of the message, for which I need an asymmetric cryptographic scheme, if I'm not wrong. $\endgroup$ – M-elman Dec 6 '16 at 18:12
  • 1
    $\begingroup$ @M-elman I do not know your use case, but a MAC can be created/validated by anyone who holds the secret key; A digital signature allows any number of parties to verify authenticity/integrity, without giving them the ability to create authentic messages. $\endgroup$ – Ella Rose Dec 6 '16 at 18:14
  • 1
    $\begingroup$ @LuisCasillas My problem was in the understanding the meanings of authenticity and integrity. Anyway I appreciate your comment and I found it useful. I will keep in mind that associated data doesn't need to be sent through the channel. I take this opportunity to ask instead whether it CAN be sent in clear through the channel. $\endgroup$ – M-elman Dec 6 '16 at 21:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.