AES-GCM requires a different Initialization Vector (IV) for every new stream of data that is encrypted using the same key. TLS generates the IV by XOR-ing a random static nonce (generated from the handshake at the beginning of the session) with a zero-padded packet sequence number, which is incremented every time a new packet is encrypted. The IV is not sent in clear.

Are there any security concerns with sending the IV in clear along with the encrypted packet, where the IV is part of "additional authenticated data" so that its integrity and authenticity are protected by the GCM tag?

Also, in a hypothetical non-TLS application, is it alright to generate a new random IV for every new packet using a true random number generator (TRNG) instead of using a static nonce XOR-ed with a packet counter?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.