What is the reason for incorporating the lengths of the associated data and ciphertext into the calculation of the authentication tag in GCM? Is it for security?


Well, if the lengths were not included, then an attacker could modify the ciphertexts (or the AAD), and still have something that would be accepted by the receiver.

Here are some of the obvious ways an attacker could do this:

  • He could add (or remove) trailing 0 bits (or bytes); as long as the number blocks remains constant, this would not change the tag. Of course, this is because GCM uses an all-0 padding at the AAD and ciphertext; as designed, that's safe (because of the length block)

  • He could prepend a block of all 0's to the AAD (and if there is no AAD, he could do that to the ciphertext); because the polynomial that GHASH computes start with the 0 value, an initial 0 value would still result in a 0 (and thus not change the tag)

  • He could migrate part of the AAD to the ciphertext (or versa-visa); for example, if the AAD consists of blocks $AAD_1, AAD_2$, he could make the AAD the single block $AAD_1$, and prepend the block $AAD_2$ to the ciphertext. Again, without the length block, this would be undetected.

Of course, it would be fairly easy to tweak how GCM worked internally so that the first two methods wouldn't work (use a padding method other than all-0's, start the polynomial with the value $H$ rather than 0); however the third attack would be harder to mitigate.

|improve this answer|||||
  • $\begingroup$ Regarding the third attack you mention, how would that work? How would the message recipient come to see $AAD_{2}$ as $CT_{1}$? $\endgroup$ – Melab Mar 12 '18 at 2:28
  • $\begingroup$ @Melab: well, you would modify the $AAD$, removing the $AAD_2$ block, and modify the ciphertext, adding the $AAD_2$ block to the start. $\endgroup$ – poncho Mar 12 '18 at 2:40
  • $\begingroup$ I'm imagining that the message that gets sent consists of the IV, additional data, the ciphertext, and the MAC concatenated together in that order, so I'm not seeing where modifications are made to perform that attack. $\endgroup$ – Melab Mar 12 '18 at 2:48
  • $\begingroup$ @Melab: with your message format, how do you decrypt? How do you tell GCM "here's where the AAD is" and "where's where the ciphertext is"? In any case, your format is not universal users of GCM; even if your format did make the attack inapplicable, there are other uses of GCM which it might not be $\endgroup$ – poncho Mar 12 '18 at 3:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.