10
$\begingroup$

I am just learning about the GCM mode of AES and I'd like to start using it in my software. However, I have a question about its use. As I understand it the output of a GCM encryption operation is the ciphertext plus an "authentication tag." I know that the key needs to be guarded from discovery, but does this authentication tag need to be protected like the key does? Or, would it be safe to prepend the ciphertext with the tag and IV and then send that whole blob through unprotected channels?

$\endgroup$
  • 1
    $\begingroup$ I think the usual way is to append the tag at the end, not prepend it. This way you can start sending your ciphertext when some of it is produced and don't have to wait until the encryption (and tag production) is over. (The decrypting side still has to wait, though.) $\endgroup$ – Paŭlo Ebermann Jul 29 '13 at 18:25
  • 1
    $\begingroup$ @PaŭloEbermann there is very little reason not to decrypt immediately when the ciphertext is received. As GCM uses CTR mode underneath, there is no such thing as a padding oracle attack. The only thing you definitely should not do is trust (and therefore use) the plaintext before the authentication has taken place. $\endgroup$ – Maarten Bodewes Jul 29 '13 at 23:00
11
$\begingroup$

The GCM authentication tag doesn't need to be encrypted. Just attach it to the ciphertext in the clear.

A very quick intuitive justification:

  • It's an authentication tag derived from the ciphertext, it doesn't contain any sensitive information itself.

  • The security of the GCM model assumes the tag is left in the open. (The GCM spec, SP 800-38D, shows the auth tag output in the clear, see section 7.1.)

$\endgroup$
  • $\begingroup$ Thank you. I suspected as much, but couldn't find any references that were explicit about transmitting the tag in the open. $\endgroup$ – Isaac Jul 29 '13 at 15:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.