Usar AES en GCM modo para authenticated cifrado
AES-GCM provides both confidentiality y integrity en un single operación, detecting tampering sin un separate HMAC. It es el recommended AES modo para la mayoría aplicaciones.
- 1
GCM (Galois/Counter Mode) combines AES-CTR for encryption with GHASH for authentication. It produces ciphertext plus a 16-byte authentication tag. If the tag does not verify on decryption, the data was tampered with and must be rejected. Never use AES-CTR alone without authentication.
- 2 Cifrador AES →
Cifrar data with AES to produce ciphertext. In GCM mode, this also generates an authentication tag that must be stored alongside the ciphertext.
- 3 Descifrador AES →
Descifrar with the same key and verify the authentication tag. If verification fails, the ciphertext was modified in transit — reject it without decrypting.
- 4
GCM requirements: a unique 96-bit nonce per encryption (never reuse with the same key), the 128-bit authentication tag must be verified before trusting plaintext. GCM is parallelizable and hardware-accelerated (AES-NI), making it the fastest authenticated mode on modern CPUs.
Preguntas frecuentes
- What happens if I reuse a GCM nonce?
- Nonce reuse in GCM is catastrophic — it leaks the authentication key (H) and allows forgery of valid tags. This is worse than nonce reuse in CTR mode. Use a counter-based or random nonce and never repeat it.
- GCM vs CBC+HMAC?
- GCM is faster (single pass, parallelizable, hardware-accelerated) and produces a shorter tag. CBC+HMAC is two passes but does not have nonce-reuse catastrophic failure. For most new systems, use GCM.