What is GCM?

Galois/Counter Mode (GCM) is an authenticated encryption mode that pairs a block cipher, almost always AES, with a Galois-field hash to produce ciphertext and an integrity tag in a single pass. It replaces the older approach of encrypting data and separately hashing it, and is now the default mode for IPsec, TLS, and DTLS.

Key takeaways

• GCM encrypts and authenticates data in a single cryptographic pass.
• It pairs a block cipher, typically AES, with GHASH authentication.
• GCM needs a unique nonce per operation; reusing one breaks security.
• Hardware-accelerated GCM outruns CBC paired with a separate hash.
• Versa’s IPsec, TLS, and DTLS transforms all offer AES-GCM ciphers.

On this page: Why it matters · How it works · Components of GCM · GCM & Versa · FAQ

Why is GCM important?

Every encrypted tunnel needs two guarantees: that an eavesdropper cannot read the data, and that an attacker cannot silently modify it in transit. Older designs met both goals with two separate steps – encrypt, then compute a hash over the result – which doubles the cryptographic work and gives implementers more chances to get the pairing wrong. GCM collapses both steps into one algorithm, so confidentiality and integrity come from a single, well-specified operation instead of a hand-assembled combination.

That efficiency matters most at scale. Modern CPUs carry dedicated instructions for both AES and the carry-less multiplication GCM’s authentication step depends on, so AES-GCM runs faster than AES-CBC-plus-hash on nearly all current hardware. That combination of stronger guarantees and lower cost is why IETF specifications for IPsec, TLS 1.2/1.3, and DTLS all name AES-GCM as a recommended or default cipher, and why it has displaced CBC-based transforms in new deployments across the industry, including Versa’s.

What is GCM?

GCM builds on counter mode (CTR): a block cipher encrypts a sequence of counter values to generate a keystream, which is XORed with the plaintext to produce ciphertext – the same construction that turns AES into a fast stream cipher. GCM adds an authentication layer on top, called GHASH, which processes the ciphertext (and any additional unencrypted header data) through multiplication in a Galois field to produce a fixed-size authentication tag, typically 128 bits.

Because both operations run over independent, parallelizable blocks, GCM processes data far faster than modes that must complete encryption before authentication can start. The tradeoff is strict input requirements: every encryption operation needs a unique nonce (initialization vector) under a given key. Reusing a nonce with GCM does not just weaken security incrementally – it can expose the authentication key and let an attacker forge valid ciphertext, which is why protocols that use GCM enforce careful nonce construction, often combining a fixed sender identifier with a strictly incrementing counter.

Components of GCM

GCM is a family of related configurations rather than one fixed algorithm. Tag length is the main variable: 128 bits is the standard and most secure choice, and the underlying specification also defines shorter, truncated tags for bandwidth-constrained links, at the cost of a weaker forgery guarantee. GMAC is GCM’s authentication-only sibling – it runs the same GHASH step without encrypting anything, useful for protecting data that must stay in plaintext but still needs integrity checking, such as packet headers.

Underlying cipher is the other variable: GCM is a generic mode that can wrap any 128-bit block cipher, but in practice it is deployed almost exclusively with AES, since AES-NI hardware acceleration is what makes GCM’s performance advantage real. The combination is written as AES-GCM, and further qualified by key size – AES-128-GCM or AES-256-GCM – and, in cipher-suite names, by the hash used for the handshake’s own key derivation, as in AES-256-GCM-SHA384.

GCM & Versa

GCM appears wherever Versa’s Secure Access Service configures tunnel cryptography. In the IKE/IPsec settings for a secure access server or SASE client profile, the IPsec (ESP) Transform list offers ESP with AES 128-bit encryption and GCM hashing and ESP with AES 256-bit encryption and GCM hashing as single named transforms – unlike the CBC options, which pair an encryption algorithm and a hash algorithm separately, GCM’s entry already bundles both.

GCM also anchors entries in the TLS and DTLS cipher suite lists offered for secure access portals and SASE client sessions, such as TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384 and TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256. These options are consistent across Secure SD-WAN, general secure access, and NGFW-fronted deployments. Where a peer supports it, AES-GCM is the preferred IPsec, TLS, and DTLS transform over an AES-CBC-plus-hash pairing, since it removes the separate hashing step and performs better on modern hardware.

Frequently asked questions

What is the difference between GCM and CBC?

CBC encrypts data but needs a separate hash, like SHA, to check integrity – two passes over the data. GCM performs encryption and integrity verification together in one pass, which is faster on modern hardware and is now the preferred mode for new IPsec, TLS, and DTLS deployments.

Why does GCM require a unique nonce for every operation?

GCM’s security proof assumes the counter sequence it generates is never reused under the same key. Reusing a nonce lets an attacker recover the authentication key and forge valid ciphertext, so implementations must construct nonces carefully, typically from a fixed value plus a strictly incrementing counter.

What is GMAC?

GMAC is GCM’s authentication-only variant. It runs the same GHASH step that produces GCM’s integrity tag, but without the accompanying encryption, so it can authenticate data that must remain readable, such as unencrypted packet headers alongside an encrypted payload.

Is GCM faster than CBC with a separate hash?

Generally yes. GCM’s counter-mode encryption and GHASH authentication both process independent blocks in parallel, and modern CPUs accelerate both operations in hardware. CBC-plus-hash requires two sequential passes over the data, so GCM typically achieves higher throughput on the same hardware.

What does AES-256-GCM mean?

It names a specific transform: AES as the block cipher, a 256-bit key, and GCM as the mode of operation providing both encryption and integrity. It is one of the strongest widely deployed options for IPsec, TLS, and DTLS, and appears directly in Versa’s ESP and cipher suite lists.

More on GCM

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about GCM, these are worth looking at next.