AES-GCM Authenticated Encryption

CBC and CTR provide confidentiality only. An attacker who can modify ciphertext can flip bits in the plaintext without being detected. GCM (Galois/Counter Mode, NIST SP 800-38D) combines CTR for encryption with GHASH for authentication, producing an AEAD mode in a single pass.

The pieces

1. H = AES-K(0^128) — the hash subkey. Derived once from the key.
2. J0 = IV-derived initial counter:
   • If IV is 96 bits (the recommended length): J0 = IV || 0x00000001
   • Otherwise: J0 = GHASH(H, IV || 0^(s+64) || [len(IV)]_64)
3. Counter encryption of P starting at inc32(J0) produces C (same as CTR).
4. GHASH(H, A || pad || C || pad || [len(A)]_64 || [len(C)]_64) computes a polynomial over GF(2^128).
5. Tag T = GHASH(...) XOR AES-K(J0), truncated to 16 bytes.

GHASH math

GF(2^128) with reduction polynomial x^128 + x^7 + x^2 + x + 1. Treat each 128-bit block as a polynomial. GHASH is essentially Y_i = (Y_{i-1} + X_i) · H, evaluated over the blocks.

Why it works (and how it can break)

• Authentication: An attacker who flips bits in C also changes the GHASH output (with overwhelming probability). The tag won't verify.
• Nonce reuse is catastrophic: Encrypting two messages with the same (K, IV) leaks P1 XOR P2 (CTR property) and leaks H itself, enabling unbounded forgery — the "Forbidden attack" (Joux). Don't reuse nonces.
• Short tags weaken security: A 128-bit tag gives 2^128 forgery resistance. Truncating to 32 bits gives 2^32 — within reach of online attacks.

In the wild

TLS 1.3, IPsec, WireGuard, SSH, age, and disk encryption (BitLocker XTS is different but kissing cousins) all use GCM or close relatives (ChaCha20-Poly1305 has the same shape: stream cipher + polynomial MAC).