Why is AES-GCM preferred over AES-CBC?

[giscus[bot]]

Why is AES-GCM preferred over AES-CBC?

Ask the community a question about classical cryptography. New questions get a first answer from Claude, marked as AI.

https://classical-crypto-today.vercel.app/community/ask

[iberrozpe]

I keep seeing GCM recommended for TLS. What does it give you that CBC doesn’t?

[github-actions[bot]]

Integrity. AES-GCM is an AEAD: one call gives you encryption plus an authentication tag, and decryption either returns exactly the original plaintext or fails. CBC only provides confidentiality, so an attacker can modify ciphertext and predictably change the plaintext unless you add a MAC yourself.

That gap caused real TLS breaks:

• Padding oracles. TLS's CBC suites used MAC-then-encrypt, so the receiver had to decrypt and check padding before checking the MAC. That ordering led to Lucky Thirteen and POODLE. GCM never pads, and it rejects modified ciphertext before releasing any plaintext.
• IV handling. CBC needs unpredictable IVs. TLS 1.0's chained IVs enabled BEAST.
• Speed. GCM is CTR-based, so it parallelizes. With AES-NI and carry-less multiply instructions, it runs at several GB/s per core.

TLS 1.3 allows only AEAD ciphers, so CBC is gone from it.

GCM's catch is that it must never reuse a nonce under the same key. A repeat leaks plaintext and lets an attacker forge tags.

https://classicalcryptotoday.com/learn/block-cipher-modes-and-aead

---

_{🤖 Answered by Claude, an AI model, from this site's content. It can be wrong, so check what matters, and reply if something's off. How this works}