I'm looking to use AES-256 GCM to encrypt and authenticate a file containing sensitive information. I am a bit loss on where to store the nonce that is required for GCM.

Would it be adequate/safe to store the nonce unencrypted at the beginning the the encrypted file?


1 Answer 1


Yes, and it is quite common to do this. As long as the nonce is unique for the given key you should be all right. Note that it is best to keep the nonce at 12 bytes (the default). No need to store the size.

Note that there is no need to put the nonce in the Additional Authenticated Data (AAD or AD) as it is already included in the calculation of the authentication tag.

Note as well that GCM does have some limitations to the number of bytes that can be encrypted ($2^{32}$ blocks of 16 bytes).

You could store a magic string and version info before encrypting so you can switch to another scheme later on.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.