# What Is AES-GCM (AES in Galois/Counter Mode)?

> AES-GCM is the AES block cipher used in Galois/Counter Mode, an AEAD construction that encrypts in counter mode and authenticates with a GHASH-based tag.

Source: https://ssl.sh/glossary/aes-gcm/
Last updated: 2026-11-10

AES-GCM combines AES in counter mode, which turns the block cipher into a keystream, with GHASH, a polynomial authenticator over a binary field, to produce ciphertext and a 128-bit authentication tag. It is specified by NIST in SP 800-38D and is an [AEAD](https://ssl.sh/glossary/aead/) algorithm. TLS uses it with 128-bit or 256-bit AES keys and a 96-bit nonce: TLS 1.2 suites such as ECDHE-RSA-AES128-GCM-SHA256, and the [TLS 1.3](https://ssl.sh/glossary/tls-1-3/) suites TLS_AES_128_GCM_SHA256 and TLS_AES_256_GCM_SHA384.

## Why it matters
AES-GCM is the most commonly negotiated TLS cipher on servers and desktop clients. Modern x86 and ARMv8 processors have dedicated AES and carry-less multiplication instructions, which make it very fast and resistant to cache-timing attacks. On processors without that hardware, software AES is slower and harder to implement in constant time, which is why [ChaCha20-Poly1305](https://ssl.sh/glossary/chacha20-poly1305/) is offered alongside it.

## Example
Benchmark AES-GCM on your server's CPU and compare the two TLS 1.3 variants:

```bash
openssl speed -evp aes-128-gcm
openssl speed -evp aes-256-gcm
```

```text
TLS 1.3: TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384
TLS 1.2: ECDHE-ECDSA-AES128-GCM-SHA256, ECDHE-RSA-AES256-GCM-SHA384
```

## Common misconceptions
- **"Only AES-256-GCM is strong enough."** AES-128 provides 128-bit security, the level TLS generally targets. AES-256 is chosen for policy or extra long-term margin, at some cost in speed.
- **"GCM nonces can repeat occasionally."** Reusing a nonce under the same key leaks the XOR of the plaintexts and lets an attacker forge tags. TLS derives nonces from record sequence numbers so this cannot happen in a correct implementation.
- **"An AES-GCM suite always provides forward secrecy."** Forward secrecy comes from the key exchange. AES128-GCM-SHA256 uses static RSA key transport and has none.

## Related terms

- [AEAD](https://ssl.sh/zh/glossary/aead/): AEAD 是带关联数据的认证加密算法，一次运算同时完成数据加密和完整性认证，并能保护不加密的附加数据不被篡改。
- [ChaCha20-Poly1305](https://ssl.sh/zh/glossary/chacha20-poly1305/): ChaCha20-Poly1305 是把 ChaCha20 流密码与 Poly1305 认证算法组合而成的 AEAD 算法，专为纯软件实现时的高速和恒定时间而设计。
- [密码套件](https://ssl.sh/zh/glossary/cipher-suite/): 密码套件是 TLS 客户端和服务器协商使用的一组命名的加密算法组合，例如 TLS_AES_128_GCM_SHA256，决定连接用什么算法保护数据。
- [TLS 1.3](https://ssl.sh/zh/glossary/tls-1-3/): TLS 1.3 是当前最新的传输层安全协议版本（2018 年的 RFC 8446，现行规范为 RFC 9846），完整握手只需一个往返，且只保留 AEAD 加密算法。
- [TLS 1.2](https://ssl.sh/zh/glossary/tls-1-2/): TLS 1.2 是 2008 年由 RFC 5246 定义的 TLS 版本，引入了基于 SHA-256 的密钥派生和 AES-GCM 等 AEAD 加密算法，至今仍被广泛使用。
- [3DES](https://ssl.sh/zh/glossary/3des/): 3DES 是把 DES 连续执行三次的分组密码，分组长度只有 64 位，主要因 Sweet32 攻击而在 TLS 中被视为应淘汰的旧算法。