Cryptology Academy · Lesson

GCM & Authenticated Encryption

Add authentication tags to encryption to prevent tampering.

Lesson 4 of 413 steps

GCM & Authenticated Encryption is a free Cryptology Academy lesson on CoddyKit. This is lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cryptology Academy learning path, and your progress syncs across the web and the CoddyKit app. The Cryptology Academy course includes 4 lessons in total.

Welcome

AES-GCM is the gold standard for authenticated encryption. It provides confidentiality AND integrity in one operation, preventing tampering without a separate HMAC step.

The Problem with Encryption Alone

Encryption provides confidentiality but NOT integrity. An attacker intercepting AES-CBC ciphertext can flip bits and change the decrypted plaintext without knowing the key.

AEAD: Authenticated Encryption with Associated Data

AEAD schemes output: ciphertext + authentication tag. The tag authenticates both the ciphertext AND optional unencrypted associated data (AAD). Any modification invalidates the tag.

GCM Architecture

AES-GCM uses: 1. AES-CTR for encryption 2. GHASH for authentication GHASH computes a polynomial MAC over the ciphertext + AAD using multiplication in GF(2^128).

GHASH Overview

GHASH(H, A, C) = hash of AAD + ciphertext using the subkey H = AES(K, 0^128). The polynomial is evaluated at H over GF(2^128). The result is XORed with the encrypted counter to form the tag.

AES-GCM Inputs and Outputs

Inputs: 128/192/256-bit key, 96-bit nonce, plaintext, optional AAD Outputs: ciphertext (same length as plaintext), 128-bit authentication tag The tag is typically 16 bytes. Truncating below 12 bytes is not recommended.

Nonce Requirements in GCM

GCM requires a unique nonce per encryption with the same key. 96-bit random nonce is standard. After 2^32 messages, collision probability exceeds 1%. At that point, rotate the key.

GCM Nonce Reuse Catastrophe

Reusing (key, nonce) in GCM: attacker can recover the GHASH subkey H, forging any ciphertext with a valid tag. This completely breaks both confidentiality and integrity.

Associated Data (AAD) Use Cases

AAD is metadata you want to authenticate but not encrypt: - HTTP header: authenticated to prevent response routing attacks - Database record ID: ensures the ciphertext is decrypted in the correct row - Protocol version: prevents downgrade attacks

AES-GCM Python Full Example

from cryptography.hazmat.primitives.ciphers.aead import AESGCM import os key = AESGCM.generate_key(256) nonce = os.urandom(12) aad = b'user_id=12345' aesgcm = AESGCM(key) ct = aesgcm.encrypt(nonce, b'secret', aad) pt = aesgcm.decrypt(nonce, ct, aad) # raises if tampered

Alternatives: ChaCha20-Poly1305

ChaCha20-Poly1305 is the other major AEAD scheme. Used in TLS 1.3 for non-AES-NI devices (ARM/mobile). Provides similar security to AES-GCM but faster on software without hardware acceleration.

Quick Check

What does the authentication tag in AES-GCM protect against?

Answer it in the interactive lesson

Recap

AES-GCM is the right default for authenticated encryption. Next we study stream ciphers: from the broken RC4 to modern ChaCha20.

Free to start

Learn Cryptology Academy with an AI tutor — free

Write and run real code in your browser, get instant help from a 24/7 AI tutor, and pick up where you left off on the web or in the app.

Courses: 67
Lessons: 261

Start learning free View the full course

Frequently Asked Questions

Is the “GCM & Authenticated Encryption” lesson free?

Yes — the full text of “GCM & Authenticated Encryption” is free to read here on the web. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cryptology Academy course, upgrade to CoddyKit PRO. The Cryptology Academy course includes 4 lessons in total.

What will I learn in “GCM & Authenticated Encryption”?

Add authentication tags to encryption to prevent tampering. You practise Cryptology Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cryptology Academy?

No prior experience is required. Cryptology Academy on CoddyKit is structured for beginners through advanced learners, so you can start here or from the beginning and move at your own pace. This is lesson 4 of 4.

How long does the “GCM & Authenticated Encryption” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cryptology Academy lesson?

Yes. Every Cryptology Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Cryptology Academy