AES-GCM External IV Encrypt Option Required for Test Suite Creation Despite FIPS Restrictions

[shivania2]

The test suite requires the AES-GCM external IV encryption option to be enabled during generation. However, according to FIPS guidelines, AES-GCM does not permit encryption using externally supplied IVs. This results in a conflict where the tool expects an option that should not be used in FIPS-compliant configurations. The purpose and necessity of enabling this option need clarification

[livebe01]

Hi @shivania2, which tool are you referring to?

https://pages.nist.gov/ACVP/draft-celi-acvp-symmetric.html#name-block-cipher-algorithm-capa defines the options available for describing the capabilities of an AES-GCM algorithm implementation when interacting with an ACVTS server. The ivGen property is used to specify whether IV generation is internal vs external.