So, my believe is that, in some way, GCM mode or any other authenticated encryption mode is useful to provide encryption and integrity for the ciphertext altogether instead of having to handle the encryption en HMAC separately (as in CBC + HMAC).
My confusion, and this might be a little bit directly related to Java API.., is that using GCM mode I can specify:
a nonce, AAD data
So, my questions:
Is the nonce used to generate a "probabilistic ciphertext", as with IV in CBC mode? Is the nonce also used as key to generate the HMAC for the ciphertext? And therefore only specifying this one I would already obtain an authenticated ciphertext (without having to specify the AAD data)?
Or is the AAD data the one used to generate the HMAC for the ciphertext (I'm pretty sure it's not)? And if not, what is the AAD used for? "To provide an additional context HMAC to accompany the ciphertext"? Could somebody provide an example of this?
ALSO.., independently of which element is used as key to generate the HMAC for the ciphertext.. How must this one be protected? As far as I know, the nonce does not have to be random, it can be a numeric sequence like 1, 2, 3.. for each encrypted message. This seems pretty guessable by an attacker. So isn't it dangerous to use a guessable nonce, or even send it in clear with the cyphertext?
Thank you, and forgive me if I have misused some cryptography terms or words.