0Pricing
Cryptology Academy · Lesson

GCM & Authenticated Encryption

Add authentication tags to encryption to prevent tampering.

GCM & Authenticated Encryption is a free Cryptology Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cryptology Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Welcome

AES-GCM is the gold standard for authenticated encryption. It provides confidentiality AND integrity in one operation, preventing tampering without a separate HMAC step.

The Problem with Encryption Alone

Encryption provides confidentiality but NOT integrity. An attacker intercepting AES-CBC ciphertext can flip bits and change the decrypted plaintext without knowing the key.

AEAD: Authenticated Encryption with Associated Data

AEAD schemes output: ciphertext + authentication tag. The tag authenticates both the ciphertext AND optional unencrypted associated data (AAD). Any modification invalidates the tag.

GCM Architecture

AES-GCM uses: 1. AES-CTR for encryption 2. GHASH for authentication GHASH computes a polynomial MAC over the ciphertext + AAD using multiplication in GF(2^128).

GHASH Overview

GHASH(H, A, C) = hash of AAD + ciphertext using the subkey H = AES(K, 0^128). The polynomial is evaluated at H over GF(2^128). The result is XORed with the encrypted counter to form the tag.

AES-GCM Inputs and Outputs

Inputs: 128/192/256-bit key, 96-bit nonce, plaintext, optional AAD Outputs: ciphertext (same length as plaintext), 128-bit authentication tag The tag is typically 16 bytes. Truncating below 12 bytes is not recommended.

Nonce Requirements in GCM

GCM requires a unique nonce per encryption with the same key. 96-bit random nonce is standard. After 2^32 messages, collision probability exceeds 1%. At that point, rotate the key.

GCM Nonce Reuse Catastrophe

Reusing (key, nonce) in GCM: attacker can recover the GHASH subkey H, forging any ciphertext with a valid tag. This completely breaks both confidentiality and integrity.

Associated Data (AAD) Use Cases

AAD is metadata you want to authenticate but not encrypt: - HTTP header: authenticated to prevent response routing attacks - Database record ID: ensures the ciphertext is decrypted in the correct row - Protocol version: prevents downgrade attacks

AES-GCM Python Full Example

from cryptography.hazmat.primitives.ciphers.aead import AESGCM import os key = AESGCM.generate_key(256) nonce = os.urandom(12) aad = b'user_id=12345' aesgcm = AESGCM(key) ct = aesgcm.encrypt(nonce, b'secret', aad) pt = aesgcm.decrypt(nonce, ct, aad) # raises if tampered

Alternatives: ChaCha20-Poly1305

ChaCha20-Poly1305 is the other major AEAD scheme. Used in TLS 1.3 for non-AES-NI devices (ARM/mobile). Provides similar security to AES-GCM but faster on software without hardware acceleration.

Quick Check

What does the authentication tag in AES-GCM protect against?

Recap

AES-GCM is the right default for authenticated encryption. Next we study stream ciphers: from the broken RC4 to modern ChaCha20.

Frequently asked questions

Is the “GCM & Authenticated Encryption” lesson free?

Yes — the full text of “GCM & Authenticated Encryption” is free to read here on the web, and the Cryptology Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cryptology Academy course, upgrade to CoddyKit PRO.

What will I learn in “GCM & Authenticated Encryption”?

Add authentication tags to encryption to prevent tampering. You practise Cryptology Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cryptology Academy?

No prior experience is required. Cryptology Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “GCM & Authenticated Encryption” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cryptology Academy lesson?

Yes. Every Cryptology Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Block Cipher Fundamentals & Padding
  2. ECB vs CBC: Patterns & IVs
  3. CTR Mode & Stream-Cipher Behavior
  4. GCM & Authenticated Encryption
← Back to Cryptology Academy