How does AES GCM encryption work

Question

Previously, I used AES CBC 256 with 256 bit key and 128 bit IV.

However it seems slow so I decide to switch to AES GCM 256 bit key, 96 bit IV which has some parts I don't understand such as:

1. Auth tag: the output of AES GCM when encrypting and decrypting needs it Can I prepend it to the encrypted cipher text so it's instantly available when decrypting? Or does it need to be hidden from attacker?

2. Does reused IV cause repeated patterns in 2 encrypted cipher texts of 2 messages(2 messages are different but some letter can be identical)?

3. Reused IV in CBC is bad but in GCM is catastrophic. Let's say it's only reused for data, messages of 1 person while the others have their unique IVs, instead of nonce, it is only used for one person. Is it applicable?

4. What is AuthenticatedData? https://developer.apple.com/documentation/cryptokit/aes/gcm/3243034-seal

Answer 1

(AES-256 CBC) seems slow

AES-256 GCM encryption uses about the same number of AES operations as AES-256 CBC (often, 1 more), for a given amount of encrypted data. Reasons AES-256 GCM could be faster are limited to:

• if the implementation uses parallelization, or is otherwise better optimized
• a sizable portion of the plaintext is treated as Authenticated Data (explained below)
• AES-256 GCM is compared to AES-256 CBC + some authenticator (e.g. CBC-MAC with a derived key)

---

Authentication tag: it's part of the ciphertext, in clear. It usually is at the end, and must be for a so-called "online algorithm", since the tag becomes known to the sender only after the whole plaintext was processed.

Reused IV: in AES-GCM it's a disaster, for XOR of bytes/letters at a given position in different plaintexts matches XOR of bytes at that position in matching ciphertexts. Yes that implies (and is much worse than) "repeated patterns" as in the question. If this is a concern, use AES-GCM-SIV.

In AES-CBC reused IV is bad, but is unlikely to be a practical disaster if the first 16 bytes of ciphertext vary.

Authenticated Data: that's optional section(s) of plaintext that is not encrypted, but still is authenticated by the GCM part of AES-GCM. That's useful because

• the data (e.g. routing information) remains intelligible
• not encrypting the data saves processing time and power.