This question already has an answer here:
I plan on storing data, encrypted with AES256, where the first dozen bytes are known plaintext. ('Hello World!' for example.)
Does having this known plaintext prefix weaken AES256?
I do not care about modifications being made to the ciphertext, which result in modifications to the decrypted plaintext.
I do care about an attacker being able to decrypt any plaintext beyond the known plaintext prefix.
I expect to use counter mode, as random access is required. Does GCM have any advantage?