3

In GCM mode of encryption, what are the limitations on the mixing of plaintext and AAD (additional authenticated data)?

  • Must the AAD come before the plaintext? Or could it be after the plaintext instead?
  • Could there be both a block of AAD before the plaintext, and another block of AAD after the plaintext?
  • Is it possible for AAD and plaintext to be interleaved in some more complicated way?
Craig McQueen
  • 262
  • 2
  • 8

2 Answers2

5

To extend Conrado's answer, there are three possible ways you might mean ordering:

  • The order of things location within memory

  • The order you present things to the GCM implementation

  • The order of coefficients within the GHASH polynomial

As Conrado mentioned, it doesn't matter where things appear in memory.

And, the order of coefficents are defined within GCM; change the order, and you're no longer doing GCM. It might be secure (depending on the details of your new scheme), but it's not GCM

On the other hand, there are tricks that allow you to process things in a different order than how they appear in the polynomial.

For example, you can rearrange the GHASH polynomial to be:

$$(A_a H^a + A_{a-1} H^{a-1} + ... + A_0 H^0) H^{m+3} + \\ (M_m H^m + M_{m-1}H^{m-1} + ... + M_0H^0)H^2 +\\ TH$$

(where the AAD block is $(A_a, A_{a-1}, ..., A_0)$, the message is $(M_m, M_{m-1}, ..., M_0)$ is the message and $T$ is the block containing the AAD and message lengths)

With this formulation, you can process the AAD and the message independently, and combine them at the end.

Standard libraries don't implement this, but it certainly could be done.

poncho
  • 147,019
  • 11
  • 229
  • 360
2

In GCM, AAD is processed before the plaintext. However, this doesn't mean that it must come before the plaintext: GCM doesn't care. But this does mean that if you want to do the other way around, you will need to buffer the plaintext before feeding the AAD, then feed the plaintext to GCM aftwerwards. This should not be an issue since GCM (or any AEAD) shouldn't be used in a streaming fashion.

You could interleave AAD with plaintext, but in the end you'll have to feed all the AAD parts to GCM while buffering plaintext, then feed the plaintext.

Conrado
  • 6,414
  • 1
  • 29
  • 44