I'd like to use AES-GCM instead of HMAC for authentication and privacy in a token used in a web application, but I'm unsure how to securely tag each token with an IV. Is it safe for me to prepend the IV in front of the AES-GCM data, or do I need to protect it somehow?


1 Answer 1


It is indeed safe to send it along with the ciphertext; the attacker can't learn anything from it (other than possibly how many packets has been generated so far, if you use a counter to generate the IVs), and if the attacker modifies the IV, the resulting message will fail to decrypt (with high probability).

Existing protocols that can use GCM (TLS, IPSec) do exactly that: prepend the IV in front of the AES-GCM data.

  • $\begingroup$ Complementary comment following previous implementation of gcm-aes : iv has as indicated to be appended in clear form with the ciphertext but in addition it must be part of the clear AD data sequence included in mac computation so to prevent at 100% from iv modification. lastly gcm cannot really be compared with hmac which only performs mac based authentication and not encryption $\endgroup$
    – william_fr
    Jul 6, 2013 at 11:51
  • 1
    $\begingroup$ @william_fr: well, no, for GCM, you don't need to include the IV as a part of the AAD; any modification to the IV with modify the authentication tag anyways. Of course, it doesn't hurt anything to include the IV in the AAD either. $\endgroup$
    – poncho
    Jul 6, 2013 at 13:54
  • $\begingroup$ you are right as iv is internally used by ghash function (gcm/gmac specifity). In my application the complete security header (key number, iv , anti replay counter ...) is de facto included in AD data but as you indicate it was not mandatory for the iv (redundant protection).thanks for the correction. $\endgroup$
    – william_fr
    Jul 6, 2013 at 15:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.