Encryption Without Authentication Is Risky
Plain encryption keeps data secret but does not prove it arrived unmodified. An attacker who cannot read ciphertext can still flip bits in it, and a naive decryptor will happily produce corrupted or attacker influenced plaintext. This class of weakness motivates authenticated encryption.
What GCM Provides
AES GCM, the Galois Counter Mode, combines a fast counter based cipher with an authentication tag. After decryption the receiver recomputes the tag and rejects the message if it does not match. This gives two guarantees at once:
- Confidentiality, so outsiders cannot read the data.
- Integrity and authenticity, so any tampering is detected and rejected.
GCM also supports additional authenticated data, letting you bind headers or context that are authenticated but not encrypted.
Operational rules are strict:
- The nonce must be unique for every message under a key.
- Reject the message if the tag check fails, and never use the decrypted bytes first.
Key idea
Use authenticated encryption like AES GCM so messages are both secret and tamper evident, and always verify the tag before trusting any decrypted bytes.