Stateless AEAD (AES-GCM) based tokens

Question

I want to generate secure data tokens which can be shared with the client for uses like password reset, etc. which involves low storage overhead at server end. Ideally I am interested only in managing the secret key.

From what I understand, AES-GCM needs a Key and a Nonce along with Data (and optionally Additional Data). It generates a Tag and Cipher Text after encryption.

To decrypt, same Nonce, Key, and Tag are needed along with Cipher Text.

Key of course needs to be kept secret but I want to avoid the overhead of storing the Nonce and Tag which I understand would be unique to each such token.

Is it safe to share the Nonce and Tag along with CipherText with the client?

The client is just suppose to return the token and not read/temper it. Its for web apps and you can assume that all communication is happening over TLS.

Answer 1

JSON Web Encryption essentially does this. Additionally it lets you select different Content Encryption Key (CEK) for each token.

BASE64URL(UTF8(JWE Protected Header)) || '.' || 
BASE64URL(JWE Encrypted Key) || '.' || 
BASE64URL(JWE Initialization Vector) || '.' || 
BASE64URL(JWE Ciphertext) || '.' || 
BASE64URL(JWE Authentication Tag)

For my case, I could select the alg as dir so that CEK essentially is the symmetric key I specify and it would precisely be what I wanted.