What happens if I reuse a GCM nonce?

Nonce reuse in GCM is catastrophic — it leaks the authentication key (H) and allows forgery of valid tags. This is worse than nonce reuse in CTR mode. Use a counter-based or random nonce and never repeat it.

GCM is faster (single pass, parallelizable, hardware-accelerated) and produces a shorter tag. CBC+HMAC is two passes but does not have nonce-reuse catastrophic failure. For most new systems, use GCM.

TASK

Use AES in GCM mode for authenticated encryption

AES-GCM provides both confidentiality and integrity in a single operation, detecting tampering without a separate HMAC. It is the recommended AES mode for most applications.

1

GCM (Galois/Counter Mode) combines AES-CTR for encryption with GHASH for authentication. It produces ciphertext plus a 16-byte authentication tag. If the tag does not verify on decryption, the data was tampered with and must be rejected. Never use AES-CTR alone without authentication.
2

AES Encryptor →
Encrypt data with AES to produce ciphertext. In GCM mode, this also generates an authentication tag that must be stored alongside the ciphertext.
3

AES Decryptor →
Decrypt with the same key and verify the authentication tag. If verification fails, the ciphertext was modified in transit — reject it without decrypting.
4

GCM requirements: a unique 96-bit nonce per encryption (never reuse with the same key), the 128-bit authentication tag must be verified before trusting plaintext. GCM is parallelizable and hardware-accelerated (AES-NI), making it the fastest authenticated mode on modern CPUs.

Frequently asked questions

What happens if I reuse a GCM nonce?: Nonce reuse in GCM is catastrophic — it leaks the authentication key (H) and allows forgery of valid tags. This is worse than nonce reuse in CTR mode. Use a counter-based or random nonce and never repeat it.
GCM vs CBC+HMAC?: GCM is faster (single pass, parallelizable, hardware-accelerated) and produces a shorter tag. CBC+HMAC is two passes but does not have nonce-reuse catastrophic failure. For most new systems, use GCM.