Utiliser AES en GCM mode pour authenticated chiffrement
AES-GCM provides both confidentiality et integrity en un single opération, detecting tampering sans un separate HMAC. It est le recommended AES mode pour la plupart applications.
- 1
GCM (Galois/Counter Mode) combines AES-CTR for encryption with GHASH for authentication. It produces ciphertext plus a 16-byte authentication tag. If the tag does not verify on decryption, the data was tampered with and must be rejected. Never use AES-CTR alone without authentication.
- 2 Chiffreur AES →
Chiffrer data with AES to produce ciphertext. In GCM mode, this also generates an authentication tag that must be stored alongside the ciphertext.
- 3 Déchiffreur AES →
Déchiffrer with the same key and verify the authentication tag. If verification fails, the ciphertext was modified in transit — reject it without decrypting.
- 4
GCM requirements: a unique 96-bit nonce per encryption (never reuse with the same key), the 128-bit authentication tag must be verified before trusting plaintext. GCM is parallelizable and hardware-accelerated (AES-NI), making it the fastest authenticated mode on modern CPUs.
Questions fréquentes
- What happens if I reuse a GCM nonce?
- Nonce reuse in GCM is catastrophic — it leaks the authentication key (H) and allows forgery of valid tags. This is worse than nonce reuse in CTR mode. Use a counter-based or random nonce and never repeat it.
- GCM vs CBC+HMAC?
- GCM is faster (single pass, parallelizable, hardware-accelerated) and produces a shorter tag. CBC+HMAC is two passes but does not have nonce-reuse catastrophic failure. For most new systems, use GCM.