AES-GCM (AES in Galois/Counter Mode)

AES-GCM combines AES in counter mode, which turns the block cipher into a keystream, with GHASH, a polynomial authenticator over a binary field, to produce ciphertext and a 128-bit authentication tag. It is specified by NIST in SP 800-38D and is an AEAD algorithm. TLS uses it with 128-bit or 256-bit AES keys and a 96-bit nonce: TLS 1.2 suites such as ECDHE-RSA-AES128-GCM-SHA256, and the TLS 1.3 suites TLS_AES_128_GCM_SHA256 and TLS_AES_256_GCM_SHA384.

Why it matters

AES-GCM is the most commonly negotiated TLS cipher on servers and desktop clients. Modern x86 and ARMv8 processors have dedicated AES and carry-less multiplication instructions, which make it very fast and resistant to cache-timing attacks. On processors without that hardware, software AES is slower and harder to implement in constant time, which is why ChaCha20-Poly1305 is offered alongside it.

Example

Benchmark AES-GCM on your server's CPU and compare the two TLS 1.3 variants:

openssl speed -evp aes-128-gcm
openssl speed -evp aes-256-gcm

TLS 1.3: TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384
TLS 1.2: ECDHE-ECDSA-AES128-GCM-SHA256, ECDHE-RSA-AES256-GCM-SHA384

Common misconceptions

• "Only AES-256-GCM is strong enough." AES-128 provides 128-bit security, the level TLS generally targets. AES-256 is chosen for policy or extra long-term margin, at some cost in speed.
• "GCM nonces can repeat occasionally." Reusing a nonce under the same key leaks the XOR of the plaintexts and lets an attacker forge tags. TLS derives nonces from record sequence numbers so this cannot happen in a correct implementation.
• "An AES-GCM suite always provides forward secrecy." Forward secrecy comes from the key exchange. AES128-GCM-SHA256 uses static RSA key transport and has none.