GCM mode (Galois/Counter Mode) is a mode of operation for symmetric key cryptographic block ciphers. It is an authenticated encryption algorithm designed to provide both authentication and secrecy. GCM mode is defined for block ciphers with a block size of 128 bits. GMAC is an authenticationonly variant of the GCM.
Encryption and authentication[]
As the name suggests, GCM mode combines the wellknown counter mode of encryption with the new Galois mode of authentication. The key feature is that the Galois field multiplication used for authentication can be easily computed in parallel thus permitting higher throughput than the authentication algorithms that use chaining modes, like CBC. The GF(2^{128}) field used is defined by the polynomial
The GHASH function is defined by
where H is a string of 128 zeros encrypted using the block cipher, A is data which is only authenticated (not encrypted), C is the ciphertext, m is the number of 128 bit blocks in A, n is the number of 128 bit blocks in C (the final blocks of A and C need not be exactly 128 bits), and the variable X_{i} for i = 0, ..., m + n + 1 is defined as^{[1]}
GCM mode was designed by John Viega and David A. McGrew as an improvement to CarterWegman Counter CWC mode.
On November 26, 2007 NIST announced the release of NIST Special Publication 80038D Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC making GCM and GMAC official standards.
Use[]
GCM mode is used in the IEEE 802.1AE (MACsec) Ethernet security, ANSI (INCITS) Fibre Channel Security Protocols (FCSP), IEEE P1619.1 tape storage, IETF IPsec standards^{[2]}^{[3]}, SSH ^{[4]} and TLS/SSL ^{[5]}. AESGCM is included into the NSA Suite B Cryptography.
Performance[]
GCM requires one block cipher operation and one 128bit multiplication in the Galois field per each block (128 bit) of encrypted and authenticated data. Intel has added the PCLMULQDQ instruction, highlighting its use for GCM [1]
Tag size[]
The bitlength of the tag, denoted t, is a security parameter. In general, t may be any one of the following five values: 128, 120, 112, 104, or 96. For certain applications, t may be 64 or 32, but the use of these two tag lengths constrains the length of the input data and the lifetime of the key. Appendix C in NIST SP 80038D provides guidance for these constraints (for example, if t = 32 and the maximal packet size is 2^{10} bytes, then the authentication decryption function should be invoked no more than 2^{11} times; if t = 64 and the maximal packet size is 2^{15} bytes, then the authentication decryption function should be invoked no more than 2^{32} times).
As with any tagbased authentication mechanism, if the adversary chooses a tbit tag at random, it is expected to be correct for given data with probability 2^{−t}. With GCM, however, an adversary can choose tags that increase this probability, proportional to the total length of the ciphertext and additional authenticated data (AAD). Consequently, GCM is not wellsuited for use with short tag lengths or very long messages.
In particular, if n denotes the total number of blocks in the encoding (the input to the GHASH function), then there is a method of constructing a targeted ciphertext forgery that is expected to succeed with a probability of approximately n2^{−t}. Moreover, each successful forgery in this attack increases the probability that subsequent targeted forgeries will succeed, and leaks information about the hash subkey, H. Eventually, H may be compromised entirely and the authentication assurance is completely lost.^{[6]}
Independent of this attack, an adversary may attempt to systematically guess many different tags for a given input to authenticated decryption, and thereby increase the probability that one (or more) of them, eventually, will be accepted as valid. For this reason, the system or protocol that implements GCM should monitor and, if necessary, limit the number of unsuccessful verification attempts for each key.
Patents[]
According to the authors' statement, GCM is unencumbered by patents.
See also[]
External links[]
 NIST Special Publication SP80038D defining GCM and GMAC
 RFC 4106: The Use of Galois/Counter Mode (GCM) in IPsec Encapsulating Security Payload (ESP)
 RFC 4543: The Use of Galois Message Authentication Code (GMAC) in IPsec ESP and AH
 IEEE 802.1AE  Media Access Control (MAC) Security
 IEEE Security in Storage Working Group developed the P1619.1 standard
 INCITS T11 Technical Committee works on Fibre Channel  Security Protocols project.
 InternetDraft for GCM in Secure RTP (SRTP)
Notes[]
 ↑ David A. McGrew and John Viega, “The Galois/Counter Mode of Operation (GCM)”, page 5, 2005
 ↑ RFC 4106 The Use of Galois/Counter Mode (GCM) in IPsec Encapsulating Security Payload (ESP)
 ↑ RFC 4543 The Use of Galois Message Authentication Code (GMAC) in IPsec ESP and AH
 ↑ RFC 5647 AES Galois Counter Mode for the Secure Shell Transport Layer Protocol
 ↑ RFC 5288 AES Galois Counter Mode (GCM) Cipher Suites for TLS
 ↑ Niels Ferguson, Authentication Weaknesses in GCM, 20050520
References[]
 NIST Special Publication 80038D (November, 2007) Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) for Confidentiality and Authentication
