AES-GCM

AES-GCM is an authenticated encryption mode that provides confidentiality and integrity when nonces are used correctly. It combines AES encryption with a Galois/Counter Mode authentication mechanism and can authenticate additional unencrypted data.

AES-GCM provides authenticated encryption with associated data (AEAD). Given a key and a unique nonce, it encrypts plaintext into ciphertext and produces an authentication tag. A receiver verifies the tag before accepting the decrypted plaintext, so accidental or malicious modification can be detected.

The nonce is critical: for a given key, it must never be reused with different plaintexts. In practice, a 96-bit nonce is the conventional choice. The nonce does not need to be secret, so it can usually be stored or transmitted alongside the ciphertext.

AES-GCM can authenticate additional authenticated data (AAD). AAD is not encrypted, but it is covered by the authentication tag. This is useful for metadata such as protocol headers, record identifiers, or version fields that must remain visible but must not be tampered with.

In Python, use a well-tested cryptographic library rather than implementing GCM yourself. The `cryptography` package provides an `AESGCM` API that encrypts and decrypts while handling the authentication tag as part of the returned ciphertext. Decryption fails when the key, nonce, ciphertext, or AAD is incorrect.

Key points

• AES-GCM provides both confidentiality and integrity.
• Never reuse a nonce with the same key.
• A nonce is normally public; uniqueness, not secrecy, is the key requirement.
• AAD is authenticated but remains unencrypted.
• Treat authentication failure as a failed decryption, not as usable plaintext.

Interview questions

What is AAD in AES-GCM, and when would you use it?

Additional authenticated data is input to the authentication process but is not encrypted. It is useful when some metadata must remain readable while still being protected against modification. For example, a protocol can authenticate a message type or record identifier while leaving that field visible to routers or application components.

What security properties does AES-GCM provide?

AES-GCM provides confidentiality and integrity/authenticity. Confidentiality prevents an observer from learning the plaintext, while authentication detects modification of ciphertext and authenticated data. It also supports AAD, which lets an application authenticate data without encrypting it.

Why must a GCM nonce never be reused with the same key?

GCM relies on a counter-based encryption construction and a polynomial authentication mechanism whose security assumptions depend on nonce uniqueness. Reusing a nonce with the same key can reveal relationships between plaintexts and can undermine authentication security. Therefore, applications must guarantee unique nonces for each encryption under a key.

How would you safely use AES-GCM in a Python backend?

I would use a maintained cryptographic library such as `cryptography` rather than implementing GCM primitives. I would generate or securely manage the key, create a unique nonce for every encryption under that key, and store or transmit the nonce with the ciphertext because it is not secret. If metadata needs integrity protection without encryption, I would pass it as AAD. On decryption, I would treat authentication failure as an invalid message and avoid exposing partially processed plaintext.