AES-GCM: The Recommended Authenticated Encryption Mode

Quick Answer

GCM, or Galois/Counter Mode, is the recommended AES mode here because the requirement specifically calls for authenticated encryption, and GCM is built to deliver both of the properties that phrase implies in a single pass: confidentiality, so the data at rest can't be read without the key, and authenticity and integrity, so any tampering with the ciphertext is detectable rather than silently accepted. It achieves this by combining a counter-mode encryption process with a built-in authentication tag, meaning the same operation that encrypts the data also produces a cryptographic checksum over it, and that tag is verified during decryption to confirm nothing was altered. This matters for data at rest specifically because encryption alone only protects secrecy; it says nothing about whether the ciphertext has been modified since it was written, and an attacker with write access to encrypted storage could potentially tamper with ciphertext in ways that produce exploitable changes to the decrypted plaintext under a non-authenticated mode. GCM closes that gap without requiring a separate integrity mechanism layered on top, which is more efficient than pairing an unauthenticated mode with a separate message authentication code. This authenticated-encryption requirement, along with GCM's standardization in NIST SP 800-38D, is why GCM is widely recommended over older, encryption-only modes for protecting data that could otherwise be silently tampered with. When a question specifically asks for a mode that provides both confidentiality and integrity together, GCM is the mode to recognize.