I have a symmetric key and I have the data that needs to be authenticated. So one of the solution that I have in mind is to use the AES GMAC. I know there are other MAC's such as HMAC or hash algorithms like SHA2.

However, my only constraint is that I have to use AES GMAC - others are not possible.

Does the below example make sense?

// Encrypt
/* Set cipher type and mode */
EVP_EncryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL);
/* Set IV length if default 96 bits is not appropriate */
EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN, sizeof(gcm_iv), NULL);
/* Initialise key and IV */
EVP_EncryptInit_ex(ctx, NULL, NULL, gcm_key, gcm_iv);
/* Zero or more calls to specify any AAD */    
EVP_EncryptUpdate (ctx, NULL, &outlen, gcm_aad, sizeof(gcm_aad));
/* Finalise: note get no output for GCM */
EVP_EncryptFinal_ex (ctx, outbuf, &outlen);
/* Get tag */
EVP_CIPHER_CTX_ctrl (ctx, EVP_CTRL_GCM_GET_TAG, 16, outbuf);  

Let's say this is a valid program and the Authentication TAG generated is transmitted to the other party along with the Additional Authenticated data. So does the other oarty needs to use the same procedure as I did to verify the Authentication tag?

  • Normally, signing is done asymmetrically (i.e. the signer uses his private key to sign the data, then the verifier uses the signers public key to verify the signature). AES-GCM is symmetric encryption (the same key is used to encrypt and decrypt). So, I'm struggling with the idea of using symmetric encryption for signing. What you are doing sounds more like message authentication (e.g. HMAC), which is symmetric (i.e. the same key is used by the sender and the recipient to verify the integrity of a message). purpose,
    – mti2935
    Jan 7, 2021 at 13:40
  • Maybe it would help if you could explain why you are using AES-GCM for what appears to be message authentication, rather than a function that is specifically designed for this purpose.
    – mti2935
    Jan 7, 2021 at 13:41
  • @mti2935: My apologizes, I chose my words badly. All I want to do is GMAC. I know AES-GCM performs the GMAC internally. Can I use GMAC directly? Does OpenSSL supports this? Jan 7, 2021 at 13:42
  • 2
    Is this what you are looking for?
    – nobody
    Jan 7, 2021 at 13:54
  • @nobody this looks similar to what I am looking for. Thanks Jan 7, 2021 at 14:03

1 Answer 1


Conceptually, this is possible and secure.

Whether it's a valid program in particular depends deeply on the arcana of the atrocious OpenSSL API (for example, explicitly requesting the GCM tag is required when using GCM with OpenSSL, as it will cheerfully both encrypt and decrypt with no tag ever generated or input). I'm not going to say for sure that this will work correctly but it looks correct, assuming your gcm_key and gcm_iv` are suitable lengths and generated securely.

Caveats, though:

  • Performance-wise, this is likely worse than an HMAC or other form of symmetric keyed MAC, and it's not better in any way so long as you choose a reasonable hash function. I don't actually know the performance of verifying the tag on the associated data alone, but it's unlikely to be better than something from the SHA2 or SHA3 family anyhow.
  • Unless you explicitly require that parties without the key be able to read the message, there's little reason to go through all the steps (key generation, distribution, etc.) necessary to use AEAD and then not actually encrypt the data.
  • I believe you'll still be subject to the standard limitations of AES-GCM, such as not being able to use the same key and IV for large amounts of data (the limit is just under 64GiB) without compromising the security of the algorithm. You can get around this by rotating the key and/or IV before hitting the limit (chunking your large messages), ensuring you never send that much data in any given message, or just using an algorithm without this issue (some are mentioned in the link, but they are also primarily for encryption rather than message authentication).
  • All I am looking for is the integrity of the message to be preserved. I don't need to be confidential. However, can you please elaborate on your last statement? Jan 7, 2021 at 14:11
  • Added a link and some clarification. Basically, AES-GCM uses a counter that is typically only 32 bits long and is incremented on every 128-bit block, and if you send enough data that the counter wraps around (without rotating the key or IV) you lose a lot of security, including in the tag.
    – CBHacking
    Jan 8, 2021 at 9:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .