This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

[Wireshark-bugs] [Bug 8395] IPsec ESP: add AES-GCM decryption

0

I noticed that for AES256, 36 bytes should be supplied as a key (instead of 32 bytes). What is the origin of the extra 4 bytes? And in general, what is the format that should be given for such decryption key?

asked 15 Sep '13, 06:31

YuvalAdler's gravatar image

YuvalAdler
11●1●1●3
accept rate: 0%

I noticed that for AES256, 36 bytes should be supplied as a key (instead of 32 bytes).

I'm just curious. Where did you notice that?

(15 Sep '13, 12:33) Kurt Knochner ♦

One Answer:

3

From RFC 4106 Section 8.1:

AES-GCM-ESP with a 256 bit key The KEYMAT requested for each AES GCM key is 36 octets. The first 32 octets are the 256-bit AES key, and the remaining four octets are used as the salt value in the nonce.

answered 15 Sep '13, 17:11

cmaynard's gravatar image

cmaynard ♦♦
9.4k●10●38●142
accept rate: 20%

I see, Thanks! (Kurt - this is on Wireshark 1.10.1)

(15 Sep '13, 22:17) YuvalAdler