I'm working on a project to upgrade an existing system that currently uses RC4 to encrypt a payload with a random session key. The session key is then encrypted with asymmetric public key encryption (RSA PKCS#1 OAEP). The encrypted pair are then transmitted over insecure channels as a token.

I'm looking to replace the RC4 part with AES-128-GCM. This is an interim solution on the way to using a standardised authenticated public key message exchange framework, such as OpenPGP or JOSE JWE.

To reduce the amount of work required to implement AES-128-GCM by keeping the message syntax the same, I was thinking of using a static IV/nonce shared by sender and recipient. As the session key is unique, I understand that this is as secure as using a random IV with a static key.

Is this an acceptable solution?

  • 1
    $\begingroup$ "yes" (needed more chars to post) $\endgroup$
    – SEJPM
    Feb 11 '18 at 14:53
  • $\begingroup$ Slightly longer: yes, if it wasn't your RC4 solution would be insecure as well. RC4 doesn't even use an IV, so it requires a unique key (if an IV is used then it is simply appended to the key). $\endgroup$
    – Maarten Bodewes
    Feb 11 '18 at 15:54

Yes. You can even use the nonce 0, and skip sharing state between the sender and receiver. While you're at it, consider using AES-256-GCM instead of AES-128-GCM to limit the danger of multi-target attacks.

And stop there; don't waste your time with the painfully archaic OpenPGP or hopelessly dwimmy JOSE. If you really want to switch to an existing library, consider instead using NaCl/libsodium crypto_box with a random nonce or libsodium crypto_box_seal (which has no nonce, and, as you describe, generates a session key independently at random for each message).

  • $\begingroup$ Thank you for the recommended libraries. I thought AES-128-GCM was adequate based on general opinion of AES-128 but I'll read up on that also. $\endgroup$ Feb 11 '18 at 16:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.