Symmetric encryption & AES-GCM
AES is the symmetric cipher used worldwide; GCM is the mode that turns it into authenticated encryption — confidentiality and integrity in one primitive.
In this lesson
- Explain why AES-GCM is preferred over older modes
- Describe what authentication prevents
- Encrypt and decrypt a message in Python
One key, both directions
With symmetric encryption the same key encrypts and decrypts. AES processes data in 128-bit blocks with key sizes of 128, 192 or 256 bits; no practical attack exists against full AES.
The mode of operation matters more than the cipher itself. ECB (the naive mode) leaks patterns — two identical plaintext blocks produce identical ciphertext blocks. CBC hides patterns but does not detect tampering. GCM provides both confidentiality and authenticity, and runs in parallel on modern CPUs.
| Mode | Confidentiality | Detects tampering | Verdict |
|---|---|---|---|
| ECB | Weak (leaks patterns) | No | Never use |
| CBC | Strong | No (needs HMAC) | Legacy only |
| CTR | Strong | No | Legacy only |
| GCM | Strong | Yes (auth tag) | Recommended |
| ChaCha20-Poly1305 | Strong | Yes | Recommended on mobile |
Example · TLS record layer
Every HTTPS request you make is encrypted with an AES-GCM session key. Each record carries an authentication tag: if a single byte is flipped in transit, the browser rejects the record instead of decrypting garbage.
from cryptography.hazmat.primitives.ciphers.aead import AESGCM\nimport os\n\nkey = AESGCM.generate_key(bit_length=256)\nnonce = os.urandom(12)\n\naes = AESGCM(key)\nciphertext = aes.encrypt(nonce, b"top secret", None) # includes auth tag\nprint(aes.decrypt(nonce, ciphertext, None)) # b"top secret"Authenticated means "and untampered"
Decryption fails loudly if anyone modifies the ciphertext. You never have to guess whether what you decrypted is what was sent.
Never reuse a nonce
AES-GCM with a reused nonce leaks the XOR of the plaintexts and can reveal the authentication key. Libraries generate random or counter-based nonces automatically — do not roll your own.
Encrypt, then tamper
Use the encryption lab: encrypt a message, flip one byte of the ciphertext and watch decryption fail.
How big are AES keys?
128, 192 or 256 bits. AES-256 is the common default and is approved for classified information.
Is AES quantum-proof?
Grover's algorithm halves AES strength — AES-256 still offers 128-bit security against a quantum attacker, which is why it remains the recommendation.