title: How to get the Tag information for AES-CCM decryption using openssl
body: <p>I am working on Security Application where it uses AES-CCM mode. Requirements of the application as shown in figure. </p>
  
  <p><a href="https://i.stack.imgur.com/14WkL.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/14WkL.png" alt="enter image description here"></a></p>
  
  <p>I was struck with decryption as my application is expected a TAG while decryption also. </p>
  
  <p>According to the openssl <a href="https://wiki.openssl.org/index.php/EVP_Authenticated_Encryption_and_Decryption" rel="nofollow noreferrer">EVP Authenticated Encryption and Decryption</a>, We should provide the TAG along with TAG length as below.</p>
  
  <pre><code>/* Set expected tag value. */
  if(1 != EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_CCM_SET_TAG, 14, tag))
      handleErrors();
  </code></pre>
  
  <p>If I am not setting the Tag information, the result will be all zeros. I have gone through the implementation details of AES-CCM at <a href="https://github.com/openssl/openssl/blob/master/crypto/evp/e_aes.c" rel="nofollow noreferrer">e_aes.c at line 3835</a>, and found that if the expected tag is match with generated tag then only is result is updated. (Its my understanding)</p>
  
  <p><strong>Could you please suggest me how to deal with this problem.</strong></p>
  
  <p><strong>EDIT</strong>
   I have create the image based on the requirement. Actually in the client code, they are storing the TAG value from encryption and comparing with the TAG generated while description. i.e, The comparison is happen at client code. So I need to revert the TAG which generated in Decryption to the client code.</p>