Cipher Text generated is different if nonce is greater than 12 bytes I wrote a library which uses AES-GCM-128 to perform encrypt and decrypt operations. This library uses EVP functions that provide a high level interface to OpenSSL cryptographic functions.
To verify my library implementation is correct or not, I did the below test.
I took already known nonce, key, aad, plain text which I feed into my library and got a cipher text.
Now I feed the same into an online website which gave me a different output.
The cipher text generated by the website is 56d86b2c9932554f473950900f40250f and the cipher text generated by my local implementation is 6ceedef0a0f24a0fcb8f8730288f757d
The interesting thing is that if the IV is of 12 bytes, then I get the same cipher text from online website as well as my implementation. However, if I change the IV to 16 bytes, then I get different cipher text from online website as well as implementation.
I know that Using the IV longer than 96 bits causes an additional GHASH call to convert into 96 bits.
Also, the tag generated by my local implementation is always different from the one generated online even though nonce, key, aad, plain text remains same.
Can some one please help me in understanding this behavior?
Forget the other websites for comparison, you can fall into traps of inconsistent codes. Either use the OpenSSL as a comparison or better use the NIST test vectors;
GCM Test Vectors (SP 800-38D)