Quoting Matthew Green "the only people who hate GCM are those who've had to implement it. You see, GCM is CTR mode encryption with the addition of a Carter-Weg

Quoting Matthew Green "the only people who hate GCM are those who've had to implement it. You see, GCM is CTR mode encryption with the addition of a Carter-Wegman MAC set in a Galois field. If you just went 'sfjshhuh?', you now understand what I'm talking about. Implementing GCM is a hassle in a way that most other AEADs are not. But if you have someone else's implementation -- say OpenSSL's -- it's a perfectly lovely mode." From an interesting read http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html http://blog.cryptographyengineering.com/2012/05/how-to-choos...