---
name: "libressl-EVP_aes_128_gcm"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-EVP_aes_128_gcm"
---

# libressl-EVP\_aes\_128\_gcm(3)

EVP AES cipher in Galois Counter Mode

## NAME

**EVP\_aes\_128\_gcm**, **EVP\_aes\_192\_gcm**, **EVP\_aes\_256\_gcm** – EVP AES cipher in Galois Counter Mode

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/evp.h\>**

*const* *EVP\_CIPHER* *\**\

**EVP\_aes\_128\_gcm**(*void*);

*const* *EVP\_CIPHER* *\**\

**EVP\_aes\_192\_gcm**(*void*);

*const* *EVP\_CIPHER* *\**\

**EVP\_aes\_256\_gcm**(*void*);

## DESCRIPTION

**EVP\_aes\_128\_gcm**(), **EVP\_aes\_192\_gcm**(), and **EVP\_aes\_256\_gcm**() provide the Advanced Encryption Standard algorithm for 128, 192 and 256-bit keys in and Galois Counter Mode in the evp(3) framework.

For GCM mode ciphers, the behaviour of the EVP interface is subtly altered and several additional EVP\_CIPHER\_CTX\_ctrl(3) operations are required to function correctly. Some of the EVP\_CTRL\_GCM\_\* control commands are older aliases for corresponding EVP\_CTRL\_AEAD\_\* constants as indicated below.

To avoid using the cumbersome and error-prone API documented in the present manual page, consider using the functions documented in EVP\_AEAD\_CTX\_init(3) instead.

### Configuration controls

- EVP\_CTRL\_AEAD\_SET\_IVLEN (== EVP\_CTRL\_GCM\_SET\_IVLEN)

  Set the length of the initialization vector to *arg* bytes; the *ptr* argument is ignored and passing NULL is recommended. This call can only be made before specifying an initialization vector. If not called, the default IV length of 12 bytes is used.

  Using this control command is discouraged because section 5.2.1.1 of the specification explicitly recommends that implementations of GCM restrict support to the default IV length of 12 bytes for interoperability, efficiency, and simplicity of design.

- EVP\_CTRL\_AEAD\_SET\_IV\_FIXED (== EVP\_CTRL\_GCM\_SET\_IV\_FIXED)

  Usually, -1 is passed for *arg*. In that case, the complete initialization vector is copied from *ptr*.

  Otherwise, set the fixed field at the beginning of the initialization vector to the *arg* bytes pointed to by *ptr*. When encrypting, also generate the remaining bytes of the initialization vector at random. It is an error to specify an *arg* that is less than 4 or so large that less than 8 bytes remain.

### Encryption controls

- EVP\_CTRL\_GCM\_IV\_GEN

  Generate the precounter block from the initialization vector, copy the last *arg* bytes of the initialization vector to the location pointed to by *ptr*, or all of it if *arg* is less than 1 or greater than the length of the initialization vector, and increment the initialization vector by 1. Incrementing ignores the IV length and the fixed field length that may have been configured earlier and always operates on the last eight bytes of the initialization vector. It is an error to issue this command when no key or no initialization vector is set.

- EVP\_CTRL\_AEAD\_GET\_TAG (== EVP\_CTRL\_GCM\_GET\_TAG)

  Write *arg* bytes of the tag value to the location pointed to by *ptr*. This control command only makes sense after all data has been processed, e.g. after calling EVP\_EncryptFinal(3). It is an error to issue this command while decrypting, before any data has been processed, or to specify an *arg* that is less than 1 or greater than 16.

To specify any additional authenticated data (AAD), call EVP\_EncryptUpdate(3) with the *out* argument set to NULL.

### Decryption controls

- EVP\_CTRL\_GCM\_SET\_IV\_INV

  Copy *arg* bytes from *ptr* to the last bytes of the initialization vector and generate the precounter block from the initialization vector. The library does not check whether the arguments are consistent with the configured initialization vector and fixed field lengths. When default lengths are in use, pass 8 for *arg*. In that case, this control command sets the invocation field. It is an error to issue this command when no key or no initialization vector is set, or when encrypting.

- EVP\_CTRL\_AEAD\_SET\_TAG (== EVP\_CTRL\_GCM\_SET\_TAG)

  Set the expected tag to the *arg* bytes located at *ptr*. This control command is mandatory before any data is processed, e.g. before calling EVP\_DecryptUpdate(3). It is an error to issue this command while encrypting or to specify an *arg* that is less than 1 or greater than 16.

To specify any additional authenticated data (AAD), call EVP\_DecryptUpdate(3) with the *out* argument set to NULL.

If the return value of EVP\_DecryptFinal(3), EVP\_DecryptFinal\_ex(3), EVP\_CipherFinal(3), or EVP\_CipherFinal\_ex(3) does not indicate success when decrypting, the authentication operation failed. In that case, regard any output data as corrupted.

## SEE ALSO

AES\_encrypt(3), evp(3), EVP\_AEAD\_CTX\_init(3), EVP\_aes\_128\_cbc(3), EVP\_CIPHER\_CTX\_ctrl(3), EVP\_EncryptInit(3)

## STANDARDS

Morris Dworkin, Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC, National Institute of Standards and Technology, NIST Special Publication 800-38D, Gaithersburg, Maryland, November 2007.

## HISTORY

**EVP\_aes\_128\_gcm**(), **EVP\_aes\_192\_gcm**(), and **EVP\_aes\_256\_gcm**() first appeared in OpenSSL 1.0.1 and have been available since OpenBSD 5.3.