Galois/Counter Mode, usually called AES-GCM, is an authenticated-encryption construction. It hides plaintext while authenticating the ciphertext and optional associated data, such as a sender label. If either the ciphertext or associated data is wrong, decryption fails. section 4.5.1 section 4.5.2
Build the construction from two familiar pieces:
- AES-CTR encrypts a nonce combined with a counter to produce a keystream, then XORs that keystream with the plaintext. section 4.5.2
- GMAC authenticates associated data and ciphertext, producing an authentication tag. section 4.5.2
- AES-GCM combines AES-CTR encryption with GMAC authentication, using symmetric keys for confidentiality and authentication. section 4.5.2
A browser-side message
Using the Web Crypto API, generate an AES-GCM key, create a random 12-byte IV, encode associated data and plaintext, then encrypt and decrypt with the same parameters. The IV must not be reused with the key: repeating a nonce breaks AES-GCM authentication. section 4.5.1 section 4.7
Figure 4.12 Both Alice and Bob meet in person to agree on a shared key. Alice can then use an AEAD encryption algorithm with the key to encrypt her messages to Bob. She can optionally authenticate some associated data (ad); for example, the sender of the message. After receiving the ciphertext and the authentication tag, Bob can decrypt it using the same key and associated data. If the associated data is incorrect or the ciphertext was modified in transit, the decryption fails.
Trace Alice and Bob sharing a key, authenticating associated data, and rejecting altered ciphertext or incorrect associated data. section 4.5.1
