Editing Block cipher mode of operation (section)

===={{Anchor|GCM}}Galois/counter (GCM)====
{{Main article|Galois/Counter Mode}}
{{Infobox
|name         = 
|bodystyle    = 
|title        = 
|titlestyle   = 
|image        = 
|imagestyle   = 
|caption      = 
|captionstyle = 
|headerstyle  = background:#ccf;
|labelstyle   = background:#ddf;
|datastyle    =
|header1 = GCM
|label1  = 
|data1   = 
|header2 = 
|label2  = 
|data2   = Galois/counter
|header3 = 
|label3  = Encryption parallelizable
|data3   = Yes
|header4 = 
|label4  = Decryption parallelizable
|data4   = Yes
|header5 = 
|label5  = Random read access
|data5   = Yes
|belowstyle = background:#ddf;
|below = 
}}

Galois/counter mode (GCM) combines the well-known counter mode of encryption with the new Galois mode of authentication. The key feature is the ease of parallel computation of the Galois field multiplication used for authentication. This feature permits higher throughput than encryption algorithms.

GCM is defined for block ciphers with a block size of 128 bits. Galois message authentication code (GMAC) is an authentication-only variant of the GCM which can form an incremental message authentication code. Both GCM and GMAC can accept initialization vectors of arbitrary length. GCM can take full advantage of parallel processing and implementing GCM can make efficient use of an [[instruction pipeline]] or a hardware pipeline. The CBC mode of operation incurs [[pipeline stall]]s that hamper its efficiency and performance.

Like in CTR, blocks are numbered sequentially, and then this block number is combined with an IV and encrypted with a block cipher {{math|E}}, usually AES. The result of this encryption is then XORed with the plaintext to produce the ciphertext. Like all counter modes, this is essentially a stream cipher, and so it is essential that a different IV is used for each stream that is encrypted.



{{multiple image
| header = Galois/Counter (GCM)
| width=512
| align = center
| direction = vertical
| image1 = GCM-Galois Counter Mode with IV.svg
| caption1 = GCM mode encryption
}}

The ciphertext blocks are considered coefficients of a [[polynomial]] which is then evaluated at a key-dependent point {{math|H}}, using [[finite field arithmetic]]. The result is then encrypted, producing an [[authentication tag]] that can be used to verify the integrity of the data. The encrypted text then contains the IV, ciphertext, and authentication tag.