GCM (Galois/Counter Mode)
GCM is an AEAD mode that combines CTR encryption with GHASH authentication, providing confidentiality and integrity at once, and is the preferred mode of TLS 1.2/1.3.
Purpose
It provides encryption and authentication in one pass, avoiding the two-step overhead and implementation pitfalls of CBC+HMAC.
Mechanism
CTR mode encrypts the plaintext. GHASH computes a polynomial MAC over the ciphertext blocks and AAD in GF(2^128) using the key H = E_K(0^128), producing a 128-bit authentication tag. If tag verification fails, the ciphertext is rejected.
Use cases
- TLS 1.2/1.3 AES-GCM cipher suites
- IPsec ESP
- WPA3 wireless
- Storage encryption
Examples
- Input
key + IV + plaintext + AADOutputciphertext + 16-byte tagAEAD
Common errors
- IV/nonce reuse breaks both confidentiality and integrity
- Use a counter or random IV and never repeat it
Related terms
CTR (Counter Mode)
CTR mode turns a block cipher into a stream cipher: it encrypts an incrementing counter to generate a keystream that is XORed with the plaintext, supporting parallelism and random access, but provides no integrity. GLOSSARY
CBC (Cipher Block Chaining)
CBC mode XORs the previous ciphertext block with the current plaintext before encrypting, so identical plaintext blocks yield different ciphertexts; it requires a random IV but provides no integrity authentication. GLOSSARY
Mode of Operation
A mode of operation is a scheme that lets a block cipher handle arbitrary-length data, defining how multiple plaintext blocks are chained during encryption; common ones include ECB, CBC, CTR, and GCM. GLOSSARY
IV (Initialization Vector)
An initialization vector (IV) is an input that injects randomness into block-cipher modes so that the same plaintext produces different ciphertexts across encryptions. GLOSSARY
Nonce
A nonce (number used once) is a value used only once in encryption; similar to an IV but emphasizing uniqueness over randomness, it is common in stream ciphers and AEAD. GLOSSARY