I am just learning about the GCM mode of AES and I'd like to start using it in my software. However, I have a question about its use. As I understand it the output of a GCM encryption operation is the ciphertext plus an "authentication tag." I know that the key needs to be guarded from discovery, but does this authentication tag need to be protected like the key does? Or, would it be safe to prepend the ciphertext with the tag and IV and then send that whole blob through unprotected channels?
The GCM authentication tag doesn't need to be encrypted. Just attach it to the ciphertext in the clear.
A very quick intuitive justification:
It's an authentication tag derived from the ciphertext, it doesn't contain any sensitive information itself.
The security of the GCM model assumes the tag is left in the open. (The GCM spec, SP 800-38D, shows the auth tag output in the clear, see section 7.1.)