3 ms·

I think you're confused? AES-GCM is an authenticated encryption mode. HMAC-SHA256 is just a cryptographic MAC. The two only share the same applications when the

by nly 12y ago

I think you're confused? AES-GCM is an authenticated encryption mode. HMAC-SHA256 is just a cryptographic MAC. The two only share the same applications when the latter is combined with a non-authenticated encryption mode in an Encrypt-then-MAC construction. The problem with the polynomial AE modes is they are trickier to implement (AES is actually small, as is SHA).

mmastrac 12y ago
In many cases where you use an HMAC, you'll also want to encrypt as well (ie: web cookies, tokens, etc). Because of this, I find it's much better just to go with AES-GCM from the start rather than discovering that you don't want to leak your internal DB identifiers later and tacking on the encrypt-then-mac. It also means that the implementation of the algorithm does the work of both authentication and privacy, whereas with HMAC-SHA256 (and HMAC-SHA256 + AES-CBC/CTR) you will see developers hand-rolling more of it, leaving more room for them to do it wrong. I also prefer that AES-GCM is a mode itself, while encrypt-then-mac generally requires a developer to do research into the appropriate encryption mode and other details required to "get this right".