AES-GCM.

An authenticated encryption mode that combines AES in counter mode with a GHASH-based authentication tag for confidentiality and integrity in a single pass. It belongs to the Cryptography category of cybersecurity.

An authenticated encryption mode that combines AES in counter mode with a GHASH-based authentication tag for confidentiality and integrity in a single pass.

AES-GCM (Galois/Counter Mode) is the authenticated encryption with associated data (AEAD) mode standardised in NIST SP 800-38D. It uses AES (128-bit block, 128/192/256-bit keys) in CTR mode for encryption and a GF(2^128) GHASH function to produce a 128-bit authentication tag over the ciphertext and additional authenticated data. AES-GCM is the default cipher suite for TLS 1.2/1.3, IPsec, SSH, and 802.11ac because of its parallelisability and AES-NI hardware acceleration. Its main weakness is catastrophic failure on IV reuse: repeating a 96-bit nonce under the same key allows recovery of the authentication key and plaintext, so nonces must be unique per key.

Defences for AES-GCM typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Galois/Counter Mode, AES-128-GCM, AES-256-GCM.