AES256-GCM Is it safe to both add the IV to the AAD and use it in the encryption?

fadedbee

5/28/23, 11:00 AM

I'm looking at a protocol which adds the IV (used for the encryption) into the AAD.

If the IV (which is part of the message) was incorrect, decryption would fail anyway.

Why is it useful to add the IV to AES256-GCM's AAD?

Is it actively harmful?

155

0 + 0

encryption

aes-gcm

kelalaka

5/28/23, 12:26 PM

The IV is generally pre-prepended to ciphertext. Did they omit this? The IV is only on the AAD or there is already two IVs around? Any link to the paper/source? Please not a paper from senior undergraduate papers.

SAI Peregrinus

5/28/23, 3:15 PM

Maybe they're thinking of Authenticated Hedged Encryption with Associated Data (AHEAD): using an AEAD like AES-GCM, use a MAC of the message as the IV (with the encryption key as the MAC key), then sticking a random nonce in the AAD. That makes it key-committing, authenticated, non-deterministic encryption. It takes 2 passes, and there are better constructs for AHEAD than using AES-GCM, but it's safe enough. (If you want AES, it's possible to use AES-GCM-SIV with a random 256-bit nonce in the AAD followed by a key check value, but that takes more design.)

SAI Peregrinus

6/2/23, 4:40 PM

This question needs some clarity to properly answer. Why do you think the IV is part of the message? What's the context of the protocol? It's possible to have the IV in the AAD and everything will be fine, the IV is not secret data, so adding the IV to the AAD isn't harmful on its own. But AES256-GCM doesn't specify how to pick the IV, and putting it in the AAD is weird, so it's possible wherever you saw this is doing something wildly unsafe! Without a link to the source we can't really answer whether this case is harmful.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: AES256-GCM Is it safe to both add the IV to the AAD and use it in the encryption?

TH: AES256-GCM ปลอดภัยหรือไม่ที่จะเพิ่ม IV ลงใน AAD และใช้ในการเข้ารหัส

RO: AES256-GCM Este sigur să adăugați IV-ul la AAD și să îl folosiți în criptare?

RU: AES256-GCM Безопасно ли добавлять IV в AAD и использовать его в шифровании?

VI: AES256-GCM Có an toàn không khi thêm IV vào AAD và sử dụng nó trong mã hóa?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.