AES-256-GCM Authenticated Encryption: How to Secure Data in the Browser

What Is AES and How Does Modern Symmetric Cryptography Work?

The Advanced Encryption Standard (AES), standardized by the US National Institute of Standards and Technology (NIST FIPS 197), is the gold standard symmetric block cipher protecting modern internet communications (TLS 1.3), database storage encryption, disk volumes (BitLocker, FileVault), and zero-knowledge cloud applications.

As a symmetric cipher, AES uses the same secret key for both encryption and decryption. It operates on fixed 128-bit (16-byte) blocks of data through multiple rounds of substitution and permutation operations (SubBytes, ShiftRows, MixColumns, and AddRoundKey):

• AES-128: 10 rounds (128-bit key)
• AES-192: 12 rounds (192-bit key)
• AES-256: 14 rounds (256-bit key)

AES-256 provides a theoretical keyspace of $2^{256} \approx 1.15 \times 10^{77}$ combinations, rendering brute-force attacks physically impossible with classical computers.

The Critical Role of Block Cipher Modes

A raw block cipher can only transform a single 16-byte block of plaintext. To encrypt arbitrary-length messages or streams, a mode of operation must be employed. The choice of mode dictates whether your encryption is robust or fatally flawed.

1. Electronic Codebook (ECB) — Fatally Insecure

In ECB mode, every 16-byte block is encrypted independently with the key. Identical plaintext blocks produce identical ciphertext blocks.

⚠️ The ECB Penguin Problem: Encrypting a bitmap image with ECB preserves the visual contours and structure of the image in the ciphertext. Never use ECB in production.

2. Cipher Block Chaining (CBC) — Legacy Malleability

In CBC mode, each plaintext block is XORed with the preceding ciphertext block before encryption.

• Requires an Initialization Vector (IV) for the first block.
• Requires padding (PKCS#7) to round the message up to an exact multiple of 16 bytes.
• Vulnerability: CBC only provides confidentiality, not integrity. Without a secondary MAC (Message Authentication Code), CBC is susceptible to bit-flipping attacks and padding oracle attacks (such as POODLE).

3. Galois/Counter Mode (GCM) — The Gold Standard AEAD

AES-GCM combines counter-mode encryption with universal hashing over a Galois field $\text{GF}(2^{128})$.

• AEAD (Authenticated Encryption with Associated Data): Simultaneously encrypts the payload and computes a 128-bit authentication tag (GMAC).
• Tamper Resistance: If an attacker modifies even a single bit of the ciphertext or IV, decryption fails with an authentication error before any decrypted data is returned.
• No Padding Needed: Operates as a stream cipher over counter increments; plaintexts of arbitrary byte lengths are encrypted without padding.
• High Performance: Allows full pipelining and hardware acceleration via CPU instructions like Intel AES-NI and ARMv8 Cryptography.

The Nonce/IV Mandate: Why 96-Bit IV Uniqueness Is Absolute

In AES-GCM, the Initialization Vector (IV), often referred to as a nonce (number used once), initializes the counter function.

Counter Block 1 = IV (96 bits) || 0x00000001 (32 bits)
Counter Block 2 = IV (96 bits) || 0x00000002 (32 bits)

The Catastrophic “Two-Time Pad” Failure

If the same key and IV pair is reused across two different plaintexts ($P_1$ and $P_2$):

An eavesdropper XORs the two ciphertexts to cancel out the keystream entirely, revealing the direct XOR of the plaintexts. Furthermore, the Galois hash key $H$ can be recovered mathematically, allowing the attacker to forge valid authentication tags.

Standard Operating Rules for IVs:

1. Never reuse an IV with the same key.
2. IVs are not secret: The IV is prepended in the clear to the ciphertext (e.g. [12-byte IV] + [Ciphertext] + [16-byte Tag]).
3. Always use CSPRNG: In web applications, generate IVs strictly with window.crypto.getRandomValues(new Uint8Array(12)).

Architectural Comparison of AES Modes

Client-Side Web Crypto API Implementation

Modern web browsers feature hardware-accelerated, cryptographically secure primitives via the W3C Web Cryptography API (crypto.subtle).

Here is the standard implementation for AES-GCM encryption and decryption:

// 1. Generate a Cryptographically Secure 256-bit Key
async function generateAesKey() {
  return await window.crypto.subtle.generateKey(
    { name: "AES-GCM", length: 256 },
    true,
    ["encrypt", "decrypt"]
  );
}

// 2. Encrypt UTF-8 Plaintext with AES-GCM
async function encryptAesGcm(plaintext, key) {
  const ec = new TextEncoder();
  // Generate a fresh, unique 96-bit (12-byte) IV for every encryption operation
  const iv = window.crypto.getRandomValues(new Uint8Array(12));

  const ciphertextWithTag = await window.crypto.subtle.encrypt(
    { name: "AES-GCM", iv: iv, tagLength: 128 },
    key,
    ec.encode(plaintext)
  );

  // Pack IV + Ciphertext + Tag into a single buffer for transmission
  const combined = new Uint8Array(iv.length + ciphertextWithTag.byteLength);
  combined.set(iv, 0);
  combined.set(new Uint8Array(ciphertextWithTag), iv.length);

  // Return as Base64 string
  return btoa(String.fromCharCode(...combined));
}

// 3. Decrypt and Verify Integrity
async function decryptAesGcm(base64Payload, key) {
  const binaryString = atob(base64Payload);
  const combined = Uint8Array.from(binaryString, c => c.charCodeAt(0));

  // Extract 12-byte IV and Ciphertext
  const iv = combined.slice(0, 12);
  const data = combined.slice(12);

  // Decryption throws an error if authentication tag does not match
  const decrypted = await window.crypto.subtle.decrypt(
    { name: "AES-GCM", iv: iv, tagLength: 128 },
    key,
    data
  );

  return new TextDecoder().decode(decrypted);
}

Step-by-Step: Encrypting Data in Toolbox

1. Open the Tool: Visit the Toolbox AES Encryption & Decryption Utility.
2. Select Mode: Choose AES-GCM (Authenticated) for state-of-the-art security, or AES-CBC for legacy compatibility.
3. Set Key Size: Choose 256-bit for maximum cryptographic resilience.
4. Enter Plaintext & Secret Key: Input your text and provide a passphrase, or click Generate Secure Key to obtain a high-entropy hex key.
5. Client-Side Execution: The tool uses your browser’s hardware-accelerated crypto.subtle engine. Zero plaintext or keys ever touch any remote server.
6. Copy Encrypted Ciphertext: Retrieve the resulting Base64-encoded bundle containing the IV, ciphertext, and authentication tag.