AES-GCM decrypt with OpenSSL 1.1.1 - when to set the tag?

[Lynch, Andrew]

Hi,

We have an application that uses OpenSSL 1.1.1k to receive AES256-GCM encrypted messages.  The streamed data starts with a  12 byte IV, then the ciphertext and ends with the 16 byte tag.  Our decryption code is based directly on the sample code in the Wiki and the distribution.

https://wiki.openssl.org/index.php/EVP_Authenticated_Encryption_and_Decryption#Authenticated_Decryption_using_GCM_mode
https://github.com/openssl/openssl/blob/9b06ebb1edfddffea083ba36090af7eb7cad207b/demos/evp/aesgcm.c#L82-L115

First call EVP_DecryptInit_ex, set the IV length, provide key and IV.  Some number of EVP_DecryptUpdate calls.  Finally set the tag and call EVP_DecryptFinal_ex.

An external code review has now pointed out to us that we should set the tag before the IV, according to OpenSSL documentation.

https://www.openssl.org/docs/man1.1.1/man3/EVP_CIPHER_CTX_ctrl.html#GCM-and-OCB-Modes

They must be referring to the sentence "The tag length can only be set before specifying an IV."  But what exactly does this mean?  EVP_CTRL_AEAD_SET_TAG sets both the tag length and the value in a single call, unlike EVP_CTRL_AEAD_SET_IVLEN which only sets the IV length.  We do not have the tag value until the end of the message has been received.

I guess the sample code happens to work because 16 byte is the default tag size, so it is already "set" correctly before the IV is specified.

How can we convince the reviewers that this is a non-issue?

Regards,
Andrew.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mta.openssl.org/pipermail/openssl-users/attachments/20211123/12f5e71f/attachment.html>