Applied Cryptography
Which of the following correctly describes the 96-bit nonce (IV) used in AES-GCM?
- AIt need not be secret and may be generated by a counter, but the same value must never be used twice with the same key
- BIf an attacker learns it, the plaintext leaks, so it must be kept secret and stored securely just like the key
- CIt must be chosen at random every time, and generating it with a counter incremented by 1 destroys security
Show answer and explanation
Answer: A. It need not be secret and may be generated by a counter, but the same value must never be used twice with the same key
What is required of a GCM nonce is that its values never repeat (are unique) under the same key. It need not be secret, and a counter that counts transmissions satisfies the requirement. Using the same nonce twice with the same key leaks the XOR of the plaintexts, as in CTR mode, and also allows the value used for authentication to be recovered, so tags may be forged. When nonces are chosen at random, a limit is placed on the number of encryptions under one key to avoid accidental repeats (2^32 in NIST SP 800-38D).
- A. Correct. Uniqueness is the requirement; unpredictability is not.
- B. The nonce is normally sent together with the ciphertext and need not be secret.
- C. A counter is safe as long as values never repeat. The requirement differs from that for the IV of CBC mode.