# Can an AES-GCM be cracked if the key is known but the nonce isn't?

I'm kind of new in this field and I've been trying to learn it.

I'm now facing an issue where I have a couple of packages encrypted with AES-128 GCM and I have the key that was used to encrypt these packages. However, I dont know the nonce or the H.

Is there any way for these packages to be decrypted? or is the nonce not being known keeping them safe in a case like this?

Would appreciate all help. Thanks a lot!

• generally, the nonce is public. The nonce is just XOR'd with the plaintext before encryption. What is "H" in this case to you. In GCM, you would expect the nonce and the raw data to be XOR'd before it's fed to AES. Going backwards, it shouldn't be hard if you have some idea of what the raw data would be. – b degnan Mar 31 '20 at 0:18
• @bdegnan That doesn't seem like CTR mode to me. The nonce generates the input / counter for the AES block cipher, and the resulting key stream is then XORed with the plaintext to create the ciphertext. – Maarten Bodewes Mar 31 '20 at 0:25
• ..or is H your counter? Assuming that you aren't starting a 0 – b degnan Mar 31 '20 at 0:25
• @MaartenBodewes I thought it was AES(nonce XOR data XOR counter), or I did a really poor job of thinking through it. I'll defer to you. :) – b degnan Mar 31 '20 at 0:27
• Hi Alejandro and welcome! Please don't forget to follow up on comments and answers. You can comment below answers if anything is unclear, or accept them (V mark left hand side) if you think an answer answers your question. It's the best way to show appreciation, together with upvoting questions and answers (> 15 rep). – Maarten Bodewes Apr 1 '20 at 18:37

## 2 Answers

You'll have to guess the plaintext of at least one block (128 bits) that is on a 128 bit boundary from the start of the GCM ciphertext. Then you can XOR it to retrieve 128 bits of the key stream.

Now the key stream you can decrypt since you have the key. This will get you a counter value. The counter in GCM mode starts with a 12 byte nonce and the counter as four bytes: 00000002 in hexadecimals. Once you have that nonce you can generate all the other required nonce + counter values.

So yes, it is possible, but only if you can guess at least one block of the plaintext.

If, by H, you are referring to the hash key (used to create the tag), it is generated by encrypting an all-zeros block with the encryption key. So it is no trouble to regenerate that. But to recover the nonce (or often called the IV (Initial Vector)), I think only Maarten's answer will work. I believe the IV is sent in-the-clear during a key exchange, so if there was a key exchange and you had that data, it may be possible to retrieve the IV from that.