I want to provide both confidentiality and integrity for data at rest (many large files stored on disk).

I plan to encrypt the data using AES, which will cover the confidentiality requirement.

The issue is how to provide integrity:

  1. Instead of AES, use AES-GCM-SHA256 (authenticated cipher). My understanding is that this produces an HMAC (keyed hash) of the encrypted data (and IV), and appends it to the end of the file.

  2. After encrypting each file, produce an RSA digital signature, and either save it as a separate file or append it to the encrypted file.

What are the merits and disadvantages of each option?

  • $\begingroup$ By AES-GCM-SHA256, do you mean a scheme that uses a SHA256 based KDF, as in RFC 5288 specifying AES-GCM cipher suites for TLS? $\endgroup$ Apr 2, 2013 at 23:11
  • $\begingroup$ @HenrickHellström Yes, I just mean AES cipher in GCM mode using SHA256 hash. Is there a different notation I should have used? $\endgroup$
    – MurrayA
    Apr 3, 2013 at 17:12
  • $\begingroup$ AES-GCM does not use a SHA256 hash, as has been told in both answers and some comments. However, you might for some reason need to pass your key material through a KDF to generate the actual AES-GCM key before you instantiate AES-GCM, and that KDF might be based on SHA256. Is that what you mean? $\endgroup$ Apr 3, 2013 at 17:18
  • $\begingroup$ @HenrickHellström maybe I have misunderstood how AES works in GCM mode then - I thought it basically did the same job as if I used AES encryption in CBC mode and then applied an HMAC, such as HMAC-SHA-256, except it did it all in one cryptographic primitive? $\endgroup$
    – MurrayA
    Apr 3, 2013 at 21:01
  • $\begingroup$ That is AES-CBC-then-HMAC-SHA-256. AES-GCM is technically AES-CTR-then-GHASH. $\endgroup$ Apr 4, 2013 at 6:51

3 Answers 3


You got some notation wrong. There is no algorithm like "AES-GCM-SHA-256".

AES is a block cipher, i.e. a pseudorandom permutation of 128-bit blocks. It itself only allows encryption for messages of size 128 bits (= 16 bytes), with a limited security guarantee.

When you mean "encrypt the data using AES", you actually mean "use AES with some mode of operation to encrypt the data".

Galois/Counter Mode is one such mode of operation, which combines counter mode for privacy and a block-cipher based MAC (GMAC) using some finite field operations and some block cipher calls for authentication.

SHA-256 is a hash function, but neither it nor its associated HMAC function HMAC-SHA-246 are used here in any way.

When using GCM (or almost any mode) for disk encryption with changing files, you should pay attention: You shall not use the same key and initialization vector (= initial counter) twice for different data. This also means, don't simply change some parts of the file an then encrypt again only the changed parts with same initialization vector, as you are then using the same IV twice (over time).

Instead, either generate a new random IV and encrypt the whole file with it, or split the file in blocks (of a comfortable size, e.g. 4 KB or such), each of which is then encrypted using GCM mode with a separate, independent random IV. (This works better if you are encrypting your whole disk – then you would use the disk sector as your encryption unit.)

There is no point of using a signature – that only makes sense if you want to allow someone else to prove that you did produce (or at least sign) the data, without this one being able to produce it himself.

  • $\begingroup$ Regarding signatures, it isn't part of my requirements now, but for the sake of argument let's say I wanted external auditors to be able to verify the authenticity of thr data - would signatures then become a good option? $\endgroup$
    – MurrayA
    Apr 2, 2013 at 20:01
  • 2
    $\begingroup$ It might become, but then you should have a look on what you are to sign – the ciphertext (the auditors only can verify that you produced something, without knowing what), or the plaintext – then it can't be verified anymore without decrypting first, and the auditors also need the encryption key. $\endgroup$ Apr 2, 2013 at 20:04

Your options should really be either using GCM mode, or using a non-authenticated mode (such as CBC) and calculating the HMAC (with something like HMAC-SHA256) post-encryption. Using an asymmetrical encryption scheme such as RSA in this context is not very efficient or appropriate.

GCM is a good option as it combines encryption and integrity in one mechanism. You're right, GCM produces a keyed digest of the ciphertext and appends it, and also validates it upon decryption. The advantages are that you only have to worry about one key, and there's less room for error. Just a note regarding your terminology, I'm not aware that you can specify the hash algorithm (ie, AES-GCM-SHA256) for GCM mode, but I may be wrong.

The second option, encrypt-then-hmac, is fine too, but there's more room for error. I guess the advantage is that you can specify your own hash algorithm (such as SHA512, Keccak, or whatever), which may be advantageous if you're ultra-paranoid about security.

  • $\begingroup$ Why wouldn't the RSA option be appropriate? I realise it would be slower than either AE or HMAC, but I'm not too concerned about that (it would afterall only be signing a hash of each file) $\endgroup$
    – MurrayA
    Apr 2, 2013 at 19:52
  • $\begingroup$ @MurrayA: An asymmetric signature (like RSA) is useful only when you have different persons doing signing and verification. I don't see this being the case here. $\endgroup$ Apr 2, 2013 at 19:57
  • $\begingroup$ Sorry about the notation - I just mean AES cipher in GCM mode using SHA256 hash :) $\endgroup$
    – MurrayA
    Apr 2, 2013 at 19:57

The answer "GCM is a good option as it combines encryption and integrity in one mechanism. " is a bit misleading. GCM uses one after another: 1-st encryption in counter mode and then GHASH to authenticate the data. In the recent intel processors CLMUL-NI is used to speed up the GHASH operations.

Benefits of GCM over CBC+HMAC:

  1. is much faster, as the encryption of multiple blocks can be done simultaniously. ( in CBC, the next block is waiting as IV the previous encrypted block )
  2. can add Additional Authentication Data - / not encrypted data / to the final authentication TAG

Drawbacks of GCM over CBC+HMAC:

  • GCM use only one key for both operations, The GHASH key / multiplyer / is derived from the encryption key: encrypting a 128bits block of "zeros".
  • $\begingroup$ Why do you say the use of one key is a drawback? I would count that as an advantage in almost all cases. $\endgroup$
    – otus
    Jul 18, 2016 at 4:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.