# Can an AES-GCM be cracked if the key is known but the nonce isn't?

I'm kind of new in this field and I've been trying to learn it.

I'm now facing an issue where I have a couple of packages encrypted with AES-128 GCM and I have the key that was used to encrypt these packages. However, I dont know the nonce or the H.

Is there any way for these packages to be decrypted? or is the nonce not being known keeping them safe in a case like this?

Would appreciate all help. Thanks a lot!

• generally, the nonce is public. The nonce is just XOR'd with the plaintext before encryption. What is "H" in this case to you. In GCM, you would expect the nonce and the raw data to be XOR'd before it's fed to AES. Going backwards, it shouldn't be hard if you have some idea of what the raw data would be. – b degnan Mar 31 at 0:18
• @bdegnan That doesn't seem like CTR mode to me. The nonce generates the input / counter for the AES block cipher, and the resulting key stream is then XORed with the plaintext to create the ciphertext. – Maarten Bodewes Mar 31 at 0:25
• ..or is H your counter? Assuming that you aren't starting a 0 – b degnan Mar 31 at 0:25
• @MaartenBodewes I thought it was AES(nonce XOR data XOR counter), or I did a really poor job of thinking through it. I'll defer to you. :) – b degnan Mar 31 at 0:27
• Hi Alejandro and welcome! Please don't forget to follow up on comments and answers. You can comment below answers if anything is unclear, or accept them (V mark left hand side) if you think an answer answers your question. It's the best way to show appreciation, together with upvoting questions and answers (> 15 rep). – Maarten Bodewes Apr 1 at 18:37

Now the key stream you can decrypt since you have the key. This will get you a counter value. The counter in GCM mode starts with a 12 byte nonce and the counter as four bytes: 00000002 in hexadecimals. Once you have that nonce you can generate all the other required nonce + counter values.