RE: GCM format question

Scott,
This was done really to make it easy for Java JCE API users.

In Java JCE API,  there is no mechanism to emit the GCM authentication tag as a side effect of encryption.   Encryption is supposed to input a byte array and output a byte array. 

See http://docs.oracle.com/javase/7/docs/api/javax/crypto/Cipher.html
Notice this line   " This tag is appended to the ciphertext during encryption, and is verified on decryption. "

I was assuming other APIs would do the same to retrofit GCM into existing encryption interfaces which are unaware of authentication tags. That's why we went with this.

Another consideration is streaming. Suppose you are encrypting a very large chunk of data, we want streaming processors to not have to hold on to the encrypted data. That is why we put the authentication tag at the end.   If it were an attribute on CipherValue, then the streaming processor will not be able to emit any encrypted bytes until the whole  encryption is done and the authentication value is computed.

Pratik

-----Original Message-----
From: Cantor, Scott [mailto:cantor.2@osu.edu] 
Sent: Wednesday, June 13, 2012 8:42 AM
To: public-xmlsec@w3.org
Subject: GCM format question

I'm sure there's a good reason, but what is the justification for putting the GCM authentication tag at the end of the ciphertext instead of in an XML attribute or something? It seems very awkward to have to specially handle the ciphertext and split off the tag for just one algorithm. That makes adaptation to existing APIs harder than it needs to be.

-- Scott

Received on Wednesday, 13 June 2012 20:00:42 UTC