Is the nonce in GCM mode used as key for HMAC? And how to send it?

Question

So, my believe is that, in some way, GCM mode or any other authenticated encryption mode is useful to provide encryption and integrity for the ciphertext altogether instead of having to handle the encryption en HMAC separately (as in CBC + HMAC).

My confusion, and this might be a little bit directly related to Java API.., is that using GCM mode I can specify:

a nonce, AAD data

So, my questions:

Is the nonce used to generate a "probabilistic ciphertext", as with IV in CBC mode? Is the nonce also used as key to generate the HMAC for the ciphertext? And therefore only specifying this one I would already obtain an authenticated ciphertext (without having to specify the AAD data)?

Or is the AAD data the one used to generate the HMAC for the ciphertext (I'm pretty sure it's not)? And if not, what is the AAD used for? "To provide an additional context HMAC to accompany the ciphertext"? Could somebody provide an example of this?

ALSO.., independently of which element is used as key to generate the HMAC for the ciphertext.. How must this one be protected? As far as I know, the nonce does not have to be random, it can be a numeric sequence like 1, 2, 3.. for each encrypted message. This seems pretty guessable by an attacker. So isn't it dangerous to use a guessable nonce, or even send it in clear with the cyphertext?

Thank you, and forgive me if I have misused some cryptography terms or words.

Answer 1

Is the nonce used to generate a "probabilistic ciphertext", as with IV in CBC mode? Is the nonce also used as key to generate the HMAC for the ciphertext? And therefore only specifying this one I would already obtain an authenticated ciphertext (without having to specify the AAD data)?

Yes, it provides probabilistic ciphertext.

Contrary to you mentioning HMAC, GCM does use a MAC construction but it is called GMAC. The GMAC tag value is encrypted using the initial counter value, so the authentication tag - the MAC value generated by GMAC - does rely on the IV.

Or is the AAD data the one used to generate the HMAC for the ciphertext (I'm pretty sure it's not)? And if not, what is the AAD used for? "To provide an additional context HMAC to accompany the ciphertext"? Could somebody provide an example of this?

AAD - the additional authenticated data - is included in the authentication, but it isn't responsible for creating the authentication tag. Actually, it is often empty. It can be used for any data that needs to be authenticated, but doesn't need to be confidential.

For instance the header data of a mail message or IP packet could be AAD data. It might be useful to authenticate it so the receiver address isn't altered, but of course the data to route the package to the right address needs to be readable by the routers in between.

ALSO.., independently of which element is used as key to generate the HMAC for the ciphertext.. How must this one be protected? As far as I know, the nonce does not have to be random, it can be a numeric sequence like 1, 2, 3.. for each encrypted message. This seems pretty guessable by an attacker. So isn't it dangerous to use a guessable nonce, or even send it in clear with the cyphertext?

The authentication tag is protected by the same key (and for GCM, indeed, the same cipher / mode of operation) as used to keep the data confidential. So with most AEAD modes you just need one key (SIV mode cheats on this: it requires a double size key and then just splits it in half). And yes, for GCM mode you just require a unique IV/nonce, but remember that it breaks almost completely if you reuse the IV even once.

---

Please do not look at the Wikipedia pages to understand GCM, instead check section 7.1 of NIST. Note step 6: 6. Let $T=\operatorname{MSB}_t(\mathit{GCTR}_K(J_0,S))$ where $S$ is the outcome of GHASH and $J_0$ is directly derived from the IV ($T$ is the tag, $t$ the tag size and MSB the most significant - leftmost - bits, to be complete). Note that the hash is not secure without this block encrypt.

So the authentication tag is always dependent on the IV value. Note that a unique IV is required even if no data is being encrypted by GCM mode. The GMAC relies on the uniqueness of the IV, as this answer by poncho explains.