AES GCM和文件传输

Question

I would like to implement a file transfer using AES GCM, both peers share the same key. However the GCM tag that is used to verify the data integrity is computed at the end of the encryption process. So should the sender also send the tag to the receiver so he can decrypt and validate them ? Or is it considered unsafe ? (assuming the tag is encrypted and sent the same way the data are)

Answer 1

You can send the tag and you even have to, as most proper implementations of GCM will fail to decrypt the ciphertext unless you provide them with a valid tag.

To decrypt succesfully, you must have the ciphertext, the key, and the nonce. To verify the authenticity you must have the ciphertext,the tag, the key, the nonce and the assosiated data (if some was used during encryption)