Q&A

Why is AES-GCM preferred over AES-CBC?

Replying loads a widget from giscus.app and GitHub, which then see your IP address and browser details. Posting needs a GitHub account.

1. iberrozpeOct 23, 2026

   I keep seeing GCM recommended for TLS. What does it give you that CBC doesn’t?

   1. github-actionsOct 23, 2026

      Integrity. AES-GCM is an AEAD: one call gives you encryption plus an authentication tag, and decryption either returns exactly the original plaintext or fails. CBC only provides confidentiality, so an attacker can modify ciphertext and predictably change the plaintext unless you add a MAC yourself.

      That gap caused real TLS breaks:

      • Padding oracles. TLS's CBC suites used MAC-then-encrypt, so the receiver had to decrypt and check padding before checking the MAC. That ordering led to Lucky Thirteen and POODLE. GCM never pads, and it rejects modified ciphertext before releasing any plaintext.
      • IV handling. CBC needs unpredictable IVs. TLS 1.0's chained IVs enabled BEAST.
      • Speed. GCM is CTR-based, so it parallelizes. With AES-NI and carry-less multiply instructions, it runs at several GB/s per core.

      TLS 1.3 allows only AEAD ciphers, so CBC is gone from it.

      GCM's catch is that it must never reuse a nonce under the same key. A repeat leaks plaintext and lets an attacker forge tags.

      https://classicalcryptotoday.com/learn/block-cipher-modes-and-aead

      ---

      _{🤖 Answered by Claude, an AI model, from this site's content. It can be wrong, so check what matters, and reply if something's off. How this works}

Shown from GitHub by the site's server and refreshed every minute; reading it doesn't connect your browser to GitHub, and images aren't loaded.