Is it possible to avoid hash (HMAC) authentication in AES_GCM mode

[ffernando]

Hi, 

We are using QAT1.7, there is a certain use case where we will have to avoid appending a hash on the encrypt side and validating the hash on the decrypt side for AES_GCM.

I checked the field verifyDigest in CpaCySymSessionSetupData, from the description, it looks like even if set to false, this field will be ignored for authenticated ciphers like AES_GCM.

Is there any knob to disable authentication or is it possible to make changes in the SDK to avoid authentication? 

[Ronny_G_Intel · Accepted solution]

Hi ffernando,

From your issue description, I understand that you need to bypass the authentication step associated with the AES_GCM cipher. AES_GCM is an authenticated encryption algorithm that provides both confidentiality (encryption) and integrity (authentication).

You are looking into the verifyDigest field in the CpaCySymSessionSetupData structure, this field indicates whether the digest (hash) should be verified on the decryption side. However, as you've noted, for authenticated encryption algorithms like AES_GCM, this field is usually not applicable because the authentication step is an integral part of the algorithm.

Disabling Authentication: Generally, with AES_GCM, you cannot disable the authentication step without fundamentally altering the nature of the algorithm. The GCM mode is designed to provide authentication as part of its operation.

Modifying the SDK: It may be technically possible to modify the QAT SDK to skip the authentication step, but this would be non-trivial and could potentially undermine the security guarantees of the algorithm. Moreover, such a modification would be unsupported by Intel and could lead to compatibility issues or undefined behavior.

Alternative Approach: If your use case requires encryption without authentication, you might consider using a different cipher mode that does not include built-in authentication, so that you have the flexibility to handle authentication separately or omit it entirely, depending on your requirements.

Regards,

Ronny G

[Ronny_G_Intel]

Hi ffernando,

Have you had the opportunity to review my previous post? 

Please let me know if you need additional information.

Regards,

Ronny G

[Ronny_G_Intel]

Hi ffernando,

Do you have any update by any chance?

Regards,

Ronny G

[ffernando]

Thank you Ronny for your quick response.