Home / Knowledge hub / AES-GCM
Knowledge hub
AES-GCM
A widely used encryption mode that also detects tampering with the data.
What it means
AES-GCM combines the AES cipher with Galois/Counter Mode. It encrypts data and, in the same step, produces an authentication tag. When you decrypt, the tag is checked first. If a single bit of the ciphertext or the extra data has changed, decryption fails.
This is called authenticated encryption. It matters because encryption alone does not stop someone altering data in transit. With GCM, a tampered message is refused rather than quietly turned into a different message.
Why it matters
Many breaks of home-built encryption come from missing integrity checks, not weak ciphers. GCM gives you both properties from a standard library call, so the safe path is also the short one. It is the usual choice in TLS and in cloud key services.
It has one sharp edge. Using the same key with the same nonce twice breaks it badly: an attacker can learn plaintext relationships and forge tags. A team that treats the nonce as an optional parameter can undo the whole benefit.
How it shows up
You meet it wherever data is encrypted by application code: stored fields, tokens, cookies, files and messages between services. The call takes a key, a nonce, the data and optional associated data, and returns ciphertext plus a tag.
The mistakes repeat. A fixed nonce copied from an example. A counter that resets after a restart. A random 96-bit nonce used for too many messages under one key. The tag ignored or trimmed. Check how each nonce is made and whether decryption failure is treated as an error. See also nonce reuse.
Questions people ask
AES-GCM, answered
What does the GCM tag do?
The tag is a short value computed over the ciphertext and any associated data. Decryption recomputes it and refuses the message if it does not match.
It is the integrity check. Never skip it or accept a truncated tag without a good reason.
How long should a GCM nonce be?
NIST SP 800-38D recommends 96 bits, which is the length every common library expects.
Random 96-bit nonces are safe for a limited number of messages per key, so rotate keys on busy systems.
Is AES-GCM better than AES-CBC?
For most new work, yes, because GCM detects tampering and CBC alone does not. CBC without a separate integrity check has led to padding oracle attacks.
CBC can be safe if paired with a proper MAC, but that is more to get wrong.
What is associated data in GCM?
It is information that is not encrypted but is covered by the tag, such as a record id or a user id.
Binding data to its context stops an attacker moving a valid ciphertext from one record to another.
How do we check we are using it correctly?
Read the code that builds the nonce and confirm decryption errors are handled. Review how keys are stored and rotated.
A pentest can then test whether tampered or replayed encrypted values are accepted by the running app.
Sources
Where this comes from
Related
Terms that sit next to this one
Nonce reuse
Using a single-use value twice, which can break the encryption or the check built on it.
Nonce
A value issued for a single use, so it cannot be replayed later.
Initialisation vector (IV)
A starting value that makes the same data encrypt differently each time.
Symmetric encryption
Encryption where the same secret key locks and unlocks the data.
Padding oracle
An error message that lets an attacker decrypt data one piece at a time.
What if the same nonce repeats?
Encrypted values that can be altered, replayed or swapped between records are the sort of flaw we try to prove, and each finding carries the request and response. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.