8
$\begingroup$

I have read that AES GCM uses AES CTR for encryption and GMAC for authentication.

If that is correct, what is the relationship between the IV used for AES GCM and the IV used for AES CTR?

TO put the question another way, can I encrypt using GCM and then decrypt using AES CTR (ignoring authentication) and if so, what's the relationship between the IV that I pass to GCM when encrypting and the IV that I pass to AES CTR when decrypting?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
13
$\begingroup$

That's correct.

In most cases you can do what you are proposing. However be warned that by disregarding the authentication you clearly loose message authentication and bit flipping in AES-CTR encrypted stream is trivial.

You can do what you are proposing if the AES-GCM IV size is of 96 bits. AES-GCM supports also longer sizes for IVs and for those cases you would need GHASH to find the correct IV used by CTR. That having being said I believe 99% of implementation supports only 96 bit IV for AES-GCM (and rightfully so).

To obtain the CTR IV, just append the value 2 encoded as 32-bit big endian integer to the 96 bit GCM IV (equivalently adds in C notation "0x00,0x00,0x00,0x01").

Edited to change from 1 to 2 of the initial counter value. GCM acutally defines the starting counter as starting with 1, but increments it before the first encryption, thus resulting in a 2. Thanks to @TrickyDixon for pointing this out.

Improve this answer
$\endgroup$
7
  • $\begingroup$ In other words: The CTR mode of GCM uses (Nonce||Counter) as the counter, where Counter is 1-based and big-endian? $\endgroup$
    – SEJPM
    Mar 16, 2017 at 10:32
  • $\begingroup$ That's awesome - thanks very much. Incidentally, I'm not actually proposing to disregard the authentication. I have a hardware crypto accelerator that does AES-CTR but not GCM, so I am going to benchmark the performance of software GCM versus {hardware AES-CTR + software GMAC}. However, I couldn't get the encrypted data to match up between the two approaches. $\endgroup$
    – Tricky Dixon
    Mar 16, 2017 at 10:43
  • $\begingroup$ @SEJPM the internal plaintext block counter for GCM starts with 1, whereas in CTR it starts with 0 $\endgroup$
    – Richie Frame
    Mar 17, 2017 at 4:22
  • 1
    $\begingroup$ You imply I have more knowledge of this than I do! My intention was to use 3rd party crypto libraries rather than implement anything (h/w crypto interface on Freescale i.MX6 and crypto++ software). Hence I don't know anything about a GF(2^128) multiplication...and having tried naively encrypting a string with GCM and AES-CTR relating the IVs as you describe above, I don't get the same results (obviously I expect the last bytes to be different because of the MAC but I was expecting to get the same initial bitstream). So it sounds like the answer isn't quite as simple as you implied...? $\endgroup$
    – Tricky Dixon
    Mar 20, 2017 at 17:44
  • 1
    $\begingroup$ What I suggested should work. Try to test with a simple test vector like Test Case 2 of csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/gcm/… $\endgroup$
    – Ruggero
    Mar 21, 2017 at 9:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.