Galois/Counter Mode

In cryptography, Galois/Counter Mode (GCM) is a mode of operation for symmetric-key cryptographic block ciphers. The proposal was first published in 2007. The GCM algorithm belongs to the class of authenticated encryption with associated data (AEAD) methods. Given a key ${\displaystyle K}$, plaintext${\displaystyle P}$, and associated data ${\displaystyle AD}$, GCM encrypts ${\displaystyle P}$ to produce ciphertext${\displaystyle C}$ and an authentication tag ${\displaystyle T}$. ${\displaystyle T}$ is computed from the ciphertext and the unencrypted associated data. A recipient who knows ${\displaystyle K}$ can use the tag to verify that neither the ciphertext nor the associated data had been modified, and then decrypt the ciphertext to recover the plaintext.

GCM uses a block cipher with a block size of 128 bits, (commonly AES-128) run in counter mode for encryption and uses arithmetic in the Galois field GF(2) to compute the authentication tag, hence its name.

Galois Message Authentication Code (GMAC) is an authentication-only variant of GCM that can form an incremental message authentication code. Both GCM and GMAC can accept initialization vectors of arbitrary length.

Different block cipher modes of operation can have significantly different performance with the same block cipher. As a counter mode, GCM blocks are independent. This allows encryption and decryption to be parallelized, in contrast to modes like cipher block chaining (CBC) where each block relies on the previous one.

GCM was explicitly designed to be patent-free.