AES-CBC-HMAC + AES-GCM

For AES-CBC, we usually use HMAC in combination with the SHA-256 hash function to provide integrity

We apply the MAC after padding the plaintext and encrypting it over both the ciphertext and the IV; otherwise, an attacker can still modify the IV without being caught.

AES-GCM is the

main cipher used in cryptographic protocols, including several versions of the TLS protocol, which is used to secure connections to websites on the Internet. Effectively, we can say that AES-GCM encrypts the web

AES-GCM combines

the Counter (CTR) mode of operation with the GMAC message authentication code.

AES-CTR encrypts a 16-byte block made from a nonce

and an incrementing counter, and the AES output becomes a keystream that is XORed with the plaintext to produce the ciphertext. The nonce ensures each keystream is unique, preventing replay attacks and giving CTR mode the same randomness role an IV provides.

An interesting aspect of CTR mode: no padding is required.

We say that it turns a block cipher (AES) into a stream cipher. It encrypts the plaintext byte by byte.

Stream ciphers generate a keystream and encrypt by XORing it directly with the plaintext, so they don’t need padding or modes of operation and produce ciphertext the same length as the input.

Block ciphers can act like stream ciphers when used in CTR mode, which turns their block‑based structure into a byte‑by‑byte keystream generator.

The second part of AES-GCM is GMAC. It is a MAC constructed from a keyed hash (called GHASH).

GHASH is not vulnerable to length extension attacks. As this hash takes a key as input, it can theoretically be used as a MAC, but only once (otherwise, the algorithm breaks)—it’s a one-time MAC

We use a technique (due to Wegman-Carter) to transform GHASH into a many-time MAC

GMAC is effectively the encryption of the GHASH output with AES-CTR (and a different key)

AES‑GCM intertwines CTR mode with GMAC in an encrypt‑then‑MAC design: CTR handles encryption while GHASH (wrapped by GMAC) produces the authentication tag.

It derives its MAC key by encrypting an all‑zero block, uses a unique 12‑byte nonce, and relies on a counter that requires careful state management to avoid accidental nonce reuse.