Encryption / Decryption using AES-256 GCM

Question

I am new in cryptography and I am facing some complications in encryption-decryption. I am trying to use AES-GCM with a 256-bit AES key and a 96-bit nonce. I use an open source project (Vault) to create the encryption keys. Vault can encrypt/decrypt using the generated key.

The question is what should I have to encrypt data in a different application using the key generated by Vault (so Vault can decrypt afterward)? Is having only the encryption key enough, or should I export more data from Vault such as IV?

Thanks in advance if you have some advice and hope my question is clear

Answer 1

Exporting the key is sufficient.

With GCM (and block modes in general), the key and the nonce play very different roles.

The key is secret; it is known by the encryptor and the decryptor and no one else. And, you can use the same key to encrypt multiple messages.

The nonce (or IV) need not be secret; common practice is to send it along with the encrypted message. However, one limitation with GCM is that, while you can encrypt multiple messages with the same key, you must use a different nonce for each message that you encrypt with that same key. And, typically, the encryptor selects the nonce when it encrypts the message.

Because of this, it doesn't make sense to ask Vault which nonce it expects to use to decrypt; the encryptor selects it (and if Vault will be able to decrypt several messages with the same key, it'll have to use different nonces anyways).