🔐Galois/Counter Mode

NEW

Also known as: GCM

An authenticated encryption mode combining counter-mode encryption with Galois field-based authentication to provide confidentiality and integrity.

DESCRIPTION

Galois/Counter Mode (GCM) is an AEAD scheme for block ciphers, notably AES, that delivers both encryption and authentication. It uses counter mode for parallelizable encryption and a GHASH function over a Galois field to compute authentication tags. GCM offers high performance and is widely adopted in TLS, IPsec, and storage encryption. Correct nonce management is critical to security, and misuse can catastrophically break confidentiality and integrity guarantees.

ALTERNATIVE DEFINITIONS

NIST SP 800-38D

This publication specifies Galois/Counter Mode (GCM), an operation mode for symmetric key block ciphers that provides authenticated encryption.

Defines GCM formally as an authenticated encryption mode for block ciphers.

Source

RFC 5116

This document specifies an interface and algorithms for Authenticated Encryption (AE) including AES-GCM.

Places GCM within AEAD interfaces and practical algorithm specifications.

Source

RELATED TERMS

Rijndael Authenticated Encryption GMAC CTR Mode CBC Mode Nonce Initialization Vector MAC TLS

COMPETING TERMS

Counter Mode with CBC-MAC ChaCha20-Poly1305

RELATIONS

• Broader: Mode

KNOWLEDGE AREAS

Data Security Infrastructure Data Privacy & Compliance

TARGET AUDIENCE

Security Architect Cybersecurity Engineer Chief Information Security Officer Software Developer Cloud Architect

EXTERNAL SOURCES

• Wikipedia - Galois/Counter Mode
• OpenSSL - OpenSSL AES-GCM usage documentation
• MDN Web Docs - WebCrypto AES-GCM API documentation
• IETF - TLS cipher suites for AES-GCM

TOP QUESTIONS

What is Galois/Counter Mode (GCM)?

GCM is an authenticated encryption mode combining counter-mode encryption with GHASH authentication, providing confidentiality and integrity for block ciphers.

Category: Definition

Why is GCM widely used?

It offers high performance, parallelizable encryption, and built-in authentication. It is standardized and widely supported across TLS, IPsec, and modern libraries.

Category: Relevancy

What are the risks of using GCM incorrectly?

Nonce reuse can completely break security, enabling forgery and plaintext recovery. Proper random or unique nonces and key management are essential.

Category: Risk

How does GCM compare to CCM?

Both are AEAD modes; GCM is typically faster and parallelizable, while CCM is based on CTR encryption with CBC-MAC and may suit constrained environments.

Category: Comparison

What is GMAC in relation to GCM?

GMAC is the authentication-only variant of GCM that uses GHASH to compute tags without encryption, providing integrity over data.

Category: Concept

What parameters are required for GCM?

Key, nonce (IV), plaintext, optional associated data (AAD), and tag length. Implementations must ensure nonce uniqueness per key.

Category: Requirements

Is AES-GCM suitable for large-scale systems?

Yes, it is optimized for performance and parallelization. Ensure robust key lifecycle and nonce management at scale.

Category: Management

Does GCM provide forward secrecy?

Forward secrecy is a protocol property (e.g., TLS key exchange). GCM provides AEAD on the symmetric layer but not forward secrecy by itself.

Category: Misunderstanding

Where to learn implementation best practices for GCM?

Follow NIST SP 800-38D, IETF RFCs, and library documentation such as OpenSSL and WebCrypto for safe usage patterns.

Category: GettingStarted