Say that I encrypt a large file using aes-gcm and upload it somewhere. Can I then download only the first few blocks (as well as IV and tag) and decrypt them?
If not, is there another authenticated encryption that allows this?
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.Sign up to join this community
Yes, you can decrypt a single AES-GCM partially. AES-GCM uses counter mode encryption, and you can decrypt counter mode from any specific offsite, assuming you know the nonce and method to calculate the counter values. Here is a Java implementation that takes GCM encryption and decrypts the ciphertext without verifying the tag and here is a way to run CTR mode encryption from any offset - the remaining trick is to combine the two.
However, to maintain authenticity you would still need to pass all data through the GMAC construct. As most implementations will perform both the GMAC and decryption pass at the same time you therefore may need to use a separate GMAC and counter mode implementation. For Java, if I remember correctly, GCM is implemented using relatively easy to split primitives within the Bouncy Castle lightweight API (specified by the classes in the
org.bouncycastle package tree).
If you can design your own protocol you can indeed split your message into multiple chuncks and authenticate those separately. You should however make sure that an attacker cannot duplicate, delete or shuffle these chunks. Kelalaka has already indicated one scheme on how this can be done.