key = key used to encrypt the plaintext.
IV = initialization vector.
plainText = plaintext need to be encrypted.
authData = addition data need to be authenticated which is not encrypted.


cipherText = encrypted plain text.
authTag = Authentication tag required to verify authenticity of cipherText and authData


cipherText = aes-ctr(key, IV+1, plainText);
authTag = AES-CTR(key, IV, keyDependentPoint-H(key, (cipherText-aes-ctr + authdata)));

Note: IV+1 is used for generating cipherText and the first IV is saved for encrypting the generated hash at later point of time when cipherText is generated.

Ref: GCM-Galois Counter Mode with IV & Cipher

Ref: Galois/Counter Mode

am I doing any mistake?

This question is asked to ensure the above relation of AES-GCM with AES-CTR is correct and help others to understand AES-GCM in a simple and convincing way.

This question is derived from this question.

  • 2
    $\begingroup$ What is not clear with the figure given in the ref link? AES-GCM mode is authenticated mode but CTR is not. GCM mode combines CTR for encryption and Galois Message Authentication Code (GMAC) for authentication. $\endgroup$ – hardyrama Dec 12 '18 at 14:06

AES-GCM,or more generally GCM is a mode of operation for a symmetric block cipher. It stands for Galois/Counter Mode. It provides Authenticated Encryption, guaranteeing both confidentiality (data secrecy) and integrity (data authenticity).

Confidentiality is provided by the Counter Mode: roughly a counter is encrypted and the output is xored with the plaintext. If more than one block has to be encrypted, the counter is incremented.

To be secure, GCM requires that the counter is used only once (See here for details Nonce reuse vulnerability). It is usually generated as the concatenantion of a NONCE and an actual counter (e.g.: $NONCE || 0...0)$.

Please note that the standard GCM construction uses the encryption of the counter from 1 to do the actual encryption, while the encryption of the zero-counter is used in the AuthTag computation

GCM construction

From a confidentiality point of view they are the same. Indeed, AES-GCM is defined as AES-CTR + GMAC as authentication code.

The difference is that AES-CTR does not provide integrity protection and an AuthTag has to be added (could be HMAC, or CBC-MAC for example); on the other side the AES-GCM provides both protection (confidentiality and integrity).

  • $\begingroup$ AES-GCM is defined as AES-CTR + GMAC as authentication code. This is confusing as people may consider GMAC as a hash function. The other question could arise which cipher suite is used? as people may think a different cipher suite is used for GMAC. $\endgroup$ – Nayan Karan Dec 12 '18 at 14:27
  • $\begingroup$ GMAC is only a MAC, Message Authentication Code. $\endgroup$ – ddddavidee Dec 12 '18 at 14:38
  • $\begingroup$ Yes. Agree........... $\endgroup$ – Nayan Karan Dec 12 '18 at 14:42
  • $\begingroup$ @NayanKaran You might be thinking of GHASH. It's not the kind of hash you think it is. $\endgroup$ – forest Dec 15 '18 at 12:02

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.