2

I have some data which I'm encrypting using Aes-Gcm. Every time I have to encrypt the data, I generate a random nonce of the appropriate size, as well as an empty array for the tag data.

In Aes-Gcm, there is an option to provide AAD, or Additional Authenticated Data. To my knowledge, AAD is basically some plaintext data that is authenticated when you decrypt using Gcm.

Normally I believe you just prepend the nonce in plaintext. However, since the nonce is generated before the encryption is called, I was wondering if you could pass in the nonce as the AAD.

Would this be a security risk? Would it help? Or would it not matter at all?

2 Answers 2

0

It would not be a security risk, and it also would not help.

Nothing about additional authenticated data is going to prevent it from being modified in transport. You'll simply know after authentication that it's been modified when it doesn't authenticate. However, in order to perform authentication, you also need the correct nonce.

So, it doesn't matter if it's prepended as plaintext or in AAD, if it's mangled in transport (either maliciously or do to errors) you aren't going to be able to authenticate or decrypt.

0

I don't know if passing nonce as AAD would be security risk, I don't know much about the maths behind Galois authentication to answer it, other people in crypto SE might be able to answer. But you don't actually need to do that. All you need for GCM is use the same AAD used during encryption, during decryption if you want to pass authentication. AAD can be some plaintext and kept with the cipher just as nonce, why do you need to do that anyway? You can use any general tag as AAD. It only saves a few bytes/kilobytes of storage while possibly risking. And AAD is optional too, you can use GCM without AAD. What you should never do, however, is repeat nonce for the same key, it destroys both confidentiality and authentication provided. GCM is streaming mode cipher and nonce reuse has more devastating consequences than modes like CBC. I would also recommend you look GCM-SIV mode, which can help guard against IV reuse due to poor entropy source used by your random number generator. There are recommendations for using identifying information in GCM to prevent replay attacks.

EDIT: Another option if you do not need to worry about replay attacks: You can also use constant AAD for one use case. It is not a security risk and does not require transferring AAD. It also prevents using one piece of encrypted data from being used in another context in case the format happens to match

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.