AesGcm tag size?!

[ygoe]

Hello,

I'm upgrading a project from .NET 6 to .NET 8. And now there is this:

dotnet/docs#35338

I should add a tag size parameter to my AesGcm constructor. Because it seems to be somehow necessary. But unfortunately, I have no idea what that even is and what number I should put there. I'm just using that class, I don't fully understand the theoretical maths behind that encryption.

Are there any recommendations? The documentation and related issues are pretty silent here. Or should I leave it as is and disable that obsoletion warning because the class knows best itself what to do here? I'm confused. I'm told that I should change, but not how.

[ygoe]

The same goes for this one:

https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.rfc2898derivebytes.-ctor?view=net-8.0

I'm using a now obsolete constructor of the Rfc2898DeriveBytes class and now need to specify a hash algorithm. I don't even know what that algo is used for and what I should use. And advice?

[bartonjs]

I should add a tag size parameter to my AesGcm constructor. Because it seems to be somehow necessary. But unfortunately, I have no idea what that even is and what number I should put there.

if you're doing the encryption, what size buffer are you passing as the tag destination parameter? Assuming it's the same size every time, that's what you pass in the constructor. Then the Encrypt and Decrypt methods just double check that they were supplied values that correspond with your previously registered intent.

So, if what you have already is

AesGcm gcm = new AesGcm(key);
...
byte[] tag = new byte[16];
gcm.Encrypt(nonce, plaintext, ciphertext, tag);

You'd float that 16 into the constructor:

AesGcm gcm = new AesGcm(key, 16);
...
byte[] tag = new byte[16];
gcm.Encrypt(nonce, plaintext, ciphertext, tag);

If you're only decrypting, then if you are decrypting data from a standard then you should put whatever tag size the standard says into the constructor, and then it will detect for you at decryption time to make sure everything was copacetic. For example, in the COSE Specification all three supported GCM algorithm choices specify a 128-bit (16-byte) tag. So if you were decrypting CBOR data you'd do new AesGcm(key, 16), and now Decrypt will throw if you give it something other than a 16-byte tag.

I'm using a now obsolete constructor of the Rfc2898DeriveBytes class and now need to specify a hash algorithm. I don't even know what that algo is used for and what I should use. And advice?

The constructors that don't accept a hash algorithm use SHA-1. If you need to reproduce an existing value you need to specify the same hash algorithm as it previously had, so you'd pass in HashAlgorithmName.SHA1. When generating new values you are encouraged to pick a less broken algorithm, such as SHA256.

[ygoe]

what size buffer are you passing as the tag destination parameter?

That's AesGcm.TagByteSizes.MaxSize. I didn't see this until you told me to look for it again.

If you need to reproduce an existing value you need to specify the same hash algorithm as it previously had, so you'd pass in HashAlgorithmName.SHA1.

Yes, it's used to en-/decrypt data stored in a database, so I need the previous behaviour.

Thank you, this information should have been included in the obsoletion notices already. This was really easy to follow.