AES-GCM-256 (Advanced Encryption Standard with Galois/Counter Mode, defined in NIST SP 800-38D) provides Authenticated Encryption with Associated Data (AEAD). Unlike XTS, which provides confidentiality only, AES-GCM both encrypts data for confidentiality and generates a cryptographic authentication tag that allows detection of unauthorized data modification or corruption.
AES-GCM-256 is recommended when the following applies:
- Data integrity (tamper detection) is required in addition to confidentiality.
- The protected region is small enough that the 1/4 DRAM overhead is acceptable, or the Second Auth option (≤ 64 MB protected data) is usable.
- DPA resistance is required for high-security deployments.