I know that AES-GCM mode does not need padding, and its output are exactly the length of input data plus the tagging. But I am a little bit lost, as AES itself is block cipher, it could only operate on input of multiple of its block size, than when the input is not exactly multiple of its block size, what kind of data is added to fulfill AES's block requirement? I could not find any information regarding this.

2 Answers 2


The core of GCM is CTR: successive values of a counter are encrypted with AES (each value is represented over a 16-byte block), thus generating a key-dependent pseudorandom stream. Actually encryption (and decryption as well) is done by XORing that stream with the data to encrypt. The XOR is done bit by bit and can be stopped at any length without any need for padding.

(CTR mode is really about turning a block cipher into a stream cipher.)


If it's not obvious from the previous answer, think of CTR as a pseudo-one-time-pad. The plaintext does NOT pass through the cipher. A large random number (the IV) is passed through the cipher to get the first block, and that number is continually incremented to pass through the cipher for more blocks. So you need to make sure that you have enough blocks to cover all of the ciphertext. Instead of padding the plaintext, you will have a tail-end of the keystream that isn't xor-ed with any plaintext.

These blocks make a random bit stream. This lets you randomly seek deep into the ciphertext to decrypt segments of it. It lets you perform encrypted append, or random access update, operations as well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.