AES-GCM, spelled out
Companion to Alfred Menezes, Crypto 101: Building Blocks, module 5 “Authenticated encryption” (V5 slides, cryptography101.ca, December 2024), with length bounds and algorithm steps from NIST SP 800-38D.
Why confidentiality and authentication are separate goals, the three generic compositions, then AES-GCM itself: CTR mode, arithmetic in GF(2128), GMAC and Horner’s rule, the three attacks on the simplified tag — including a full derivation of the (v+1)/2128 forgery bound — and why one repeated IV ends the key. Animated step by step; press N for speaker notes.