Verwenden AES in GCM Modus für authenticated Verschlüsselung
AES-GCM provides both confidentiality und integrity in ein single Operation, detecting tampering ohne ein separate HMAC. It ist der recommended AES Modus für die meisten Anwendungen.
- 1
GCM (Galois/Counter Mode) combines AES-CTR for encryption with GHASH for authentication. It produces ciphertext plus a 16-byte authentication tag. If the tag does not verify on decryption, the data was tampered with and must be rejected. Never use AES-CTR alone without authentication.
- 2 AES-Verschlüsseler →
Verschlüsseln data with AES to produce ciphertext. In GCM mode, this also generates an authentication tag that must be stored alongside the ciphertext.
- 3 AES-Entschlüsseler →
Entschlüsseln with the same key and verify the authentication tag. If verification fails, the ciphertext was modified in transit — reject it without decrypting.
- 4
GCM requirements: a unique 96-bit nonce per encryption (never reuse with the same key), the 128-bit authentication tag must be verified before trusting plaintext. GCM is parallelizable and hardware-accelerated (AES-NI), making it the fastest authenticated mode on modern CPUs.
Häufige Fragen
- What happens if I reuse a GCM nonce?
- Nonce reuse in GCM is catastrophic — it leaks the authentication key (H) and allows forgery of valid tags. This is worse than nonce reuse in CTR mode. Use a counter-based or random nonce and never repeat it.
- GCM vs CBC+HMAC?
- GCM is faster (single pass, parallelizable, hardware-accelerated) and produces a shorter tag. CBC+HMAC is two passes but does not have nonce-reuse catastrophic failure. For most new systems, use GCM.