I have been reading about the perils of not going the pages of my own encrypt-then-mac implementation, because there so many things can go awry. So decided to use EVP_aes_256_gcm.

But some questions came to my mind, Is EVP_aes_256_gcm following some standard that would make it interoperable between different crypt toolkits ?

That is, if I use another crypt SDK with "aes256gcm" and use same key and IV, will I get same results ?

Can my encrypted text using openssl aes gcm be decrypted in other environments c#, java ?

I dont even know the details of how openssl does aes gcm, so if in another development environment the 'aec gcm' was missing I would not even know how to implement my own that matches openssl one.

1 Answer 1


There is a standard for GCM. Hopefully, OpenSSL follows the standard correctly. Since:

  • there is a standard for using GCM in SSL/TLS;
  • OpenSSL supports GCM in TLS since version 1.0.1 (see the ChangeLog);
  • GnuTLS also supports GCM in TLS;
  • OpenSSL and GnuTLS appear to be able to talk to each other;

then chances are that both OpenSSL and GnuTLS implemented GCM properly, i.e. conform to the standard.

If unsure, check with the test vectors published by NIST (search "GCM" in that page).

  • The openssl defaults are setup for TSL, e.g, IV len defaults to 12 bytes. Should/could I set IV length to 16 or 32 to make things 'safer' ?
    – boo9
    Apr 12, 2013 at 17:35
  • The actual IV length in GCM is 12 bytes. If the IV is longer, a preparatory step is performed internally, to reduce the IV length. NIST recommends that GCM implementations restrict IV length to exactly 12 bytes. So there is nothing to gain in using larger IV.
    – Tom Leek
    Apr 12, 2013 at 17:57
  • That is not what I see during my openssl tests. Increasing IV length (substring of fixed iv bytes) produces different CTEXT. Even IV lengths longer than 32bytes are accepted.
    – boo9
    Apr 12, 2013 at 18:13
  • 1
    I did not say that OpenSSL rejects IV longer than 12 bytes; only that NIST recommends that implementations reject IV longer than 12 bytes. Also, the extra bytes are not ignored; they just don't provide additional security benefits. You already have the best security you can hope for with 12 bytes.
    – Tom Leek
    Apr 12, 2013 at 18:20
  • I see, internally they may hash my IV long bytes to 12 bytes. I think I better stick with defaults else this may bite me somewhere down the road. Thank you for your feedback @tom.
    – boo9
    Apr 12, 2013 at 18:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .