Can I decrypt AES-256-GCM TLS 1.2 encrypted packets, I have the key but I don't have the IV can I still decrypt? I am getting these packets from wireshark. I know that the IV might be at the front of the encrypted text and its size is probably 12 bytes but I don't know how to get it from the encrypted text.

  • 1
    GCM has no IV, mostly if people speak of on IV for GCM they just have reused that name to supply the nonce (see this question). The nonce is also public and therefore my be prepended to the cipher text. Note that the nonce has a variable length and not a fixed like an IV. But if you don't have the nonce GCM decryption is as far as I know not possible.
    – Robert
    Jun 10 at 14:02
  • If you have the key, just let Wireshark decrypt it.. It knows what part of the packet is the IV/nonce. Jun 12 at 12:17
  • where could I input the key in wireshark? Jun 16 at 1:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.