AESGCM

AES-GCM, or AES in Galois/Counter Mode, is an authenticated encryption with associated data (AEAD) mode that provides both confidentiality and data integrity. It combines the AES block cipher in counter mode for encryption with a Galois field-based authentication (GHASH) to generate an authentication tag. The result is ciphertext that is protected against tampering, along with a tag that verifies the integrity of both the ciphertext and any associated data.

AES-GCM supports the standard AES key lengths of 128, 192, or 256 bits and uses a 128-bit block size. The nonce (IV) is typically 12 bytes (96 bits) for optimal performance; nonces of other lengths are allowed but require careful handling to preserve security. The authentication tag is commonly 16 bytes (128 bits) but can be truncated to shorter lengths such as 12, 11, 10, or as low as 4–96 bits, depending on the implementation, with shorter tags offering less integrity assurance.

Associated data (AD) can be authenticated but not encrypted, allowing protection of header information or packet metadata alongside the encrypted payload. AES-GCM is designed for high performance in both software and hardware, often benefiting from AES-NI and similar acceleration, and its authentication computation can be parallelized.

Standardization and usage: AES-GCM is specified in NIST SP 800-38D and is widely deployed in security protocols and systems, including TLS, IPsec, SSH, and other communication protocols. It remains a common choice for environments requiring efficient, provable AEAD security, though some platforms opt for alternatives like ChaCha20-Poly1305 when AES performance is limited. Proper nonce management is essential, as nonce reuse under the same key can completely compromise confidentiality and integrity.