Modes of operationRecommended
Galois/Counter Mode
Authenticated encryption (AEAD) mode
How it works
GCM combines CTR-mode encryption with a Galois-field authenticator (GHASH) that produces a tag over the ciphertext and any associated data. The receiver checks the tag before trusting the plaintext, so tampering is detected. AES-GCM is the most widely used AEAD construction in TLS, IPsec and cloud services.
Sizes: 96-bit IV recommended; authentication tag up to 128 bits
Status: Provided every nonce is unique under a key.
Strengths
- Confidentiality and integrity in one pass (authenticated encryption with associated data).
- Parallel and hardware-accelerated on modern CPUs.
- Mandatory-to-implement cipher suite in TLS 1.3 (AES-128-GCM).
Weaknesses and known attacks
- Nonce reuse is catastrophic: it exposes the XOR of plaintexts and leaks the authentication key, allowing forged messages.
- The number of messages under one key must be limited, and short tags weaken integrity.
Use it for
- TLS, IPsec, SSH and storage encryption where integrity matters
- Default choice for AES in new designs
Don't use it for
- Systems that cannot guarantee unique nonces (consider a nonce-misuse-resistant mode such as AES-GCM-SIV)
Exam tip
GCM provides confidentiality AND integrity. If a question asks for an AES mode that also authenticates the data, the answer is GCM (or CCM), not CBC or CTR.