Galois/Counter Mode

Galois/Counter Mode, usually shortened to GCM, is a mode of operation for symmetric-key cryptographic block ciphers. It belongs to the class of authenticated encryption with associated data methods, so a single pass produces both a ciphertext and an authentication tag. Given a key, a plaintext and associated data, GCM encrypts the plaintext and computes the tag from the ciphertext and the unencrypted associated data; a recipient who knows the key can use the tag to verify that neither was modified before decrypting. GCM uses a block cipher with a 128-bit block size, commonly AES-128, run in counter mode for encryption, and it uses arithmetic in the Galois field GF(2^128) to compute the tag, which gives the mode its name. An authentication-only variant called GMAC can form an incremental message authentication code. Because the counter-mode blocks are independent, encryption and decryption can be parallelized, unlike cipher block chaining, where each block relies on the previous one. The proposal was first published in 2007, and the mode was explicitly designed to be patent-free.