Symmetric Encryption

Default to AEAD

The first rule of modern symmetric crypto: use authenticated encryption with associated data (AEAD). In Go that means AES-GCM (or ChaCha20-Poly1305). AEAD gives you two things at once:

graph LR
PT["plaintext"] --> ENC["AES-GCM<br/>(key + unique nonce)"]
ENC --> CT["ciphertext + auth tag"]
CT --> DEC["Open<br/>(key + same nonce)"]
DEC -->|tag valid| PT2["plaintext"]
DEC -->|tampered| ERR["error — refuse to decrypt"]

• Confidentiality — the plaintext is hidden.
• Integrity/authenticity — a built-in tag detects any tampering; Open returns an error instead of corrupted output.

Plain modes (CBC, CTR) give only confidentiality — an attacker can flip bits undetectably. Default to AEAD and you sidestep an entire class of attacks.

See it: AES-256-GCM round trip and tamper detection

This runs here. It encrypts, decrypts back to the original, then flips one ciphertext byte to prove GCM detects tampering and refuses to decrypt. The output is booleans, so it’s deterministic despite the random key and nonce:

package main

import (
"bytes"
"crypto/aes"
"crypto/cipher"
"crypto/rand"
"fmt"
)

func main() {
// 32-byte key = AES-256, from a cryptographically secure source.
key := make([]byte, 32)
rand.Read(key)

block, _ := aes.NewCipher(key)
gcm, _ := cipher.NewGCM(block)

// A UNIQUE nonce per message. Not secret, but never reused under this key.
nonce := make([]byte, gcm.NonceSize())
rand.Read(nonce)

plaintext := []byte("attack at dawn")
// Seal prepends nothing; we carry the nonce alongside the ciphertext.
ciphertext := gcm.Seal(nil, nonce, plaintext, nil)

// Decrypt: same key + same nonce.
out, err := gcm.Open(nil, nonce, ciphertext, nil)
fmt.Println("round-trip ok:", err == nil && bytes.Equal(out, plaintext))

// Tamper: flip one bit of the ciphertext.
ciphertext[0] ^= 0x01
_, err = gcm.Open(nil, nonce, ciphertext, nil)
fmt.Println("tamper detected:", err != nil)
}

That tamper detected: true is the whole value of AEAD — a bit-flip turns into a clean error, not silent corruption. The nil last argument is associated data: extra context (a header, a user ID) that’s authenticated but not encrypted, binding the ciphertext to where it belongs.

The two rules that keep AES-GCM safe

1. The nonce must be unique per key — forever. A nonce is “number used once.” It need not be secret (store it with the ciphertext), but reusing one under the same key is catastrophic for GCM: it leaks the XOR of the two plaintexts and can expose the authentication key. Use crypto/rand for a random 12-byte nonce per message, or a counter you can guarantee never repeats.

2. The key must come from a secure source. crypto/rand for random keys; a slow KDF (argon2id) when deriving from a password; HKDF when deriving from a high-entropy secret. Never math/rand, never a hardcoded constant.

Symmetric vs asymmetric

Symmetric crypto (AES) is fast but needs both parties to already share the key — which is the hard part. Asymmetric crypto (RSA, ECDSA, X25519) uses a public/private key pair to solve key exchange and signatures, but it’s slow for bulk data. Real systems combine them: TLS uses asymmetric crypto in the handshake to agree on a symmetric session key, then encrypts traffic with fast AES-GCM. You rarely implement this yourself — you use TLS — but knowing the split explains why every protocol has a “handshake” then a “data” phase.

See also

• TLS & PKI — how asymmetric crypto bootstraps a symmetric session.
• Hashing & passwords — the one-way counterpart.
• Attacking weak crypto — nonce reuse, ECB, and hardcoded keys in the wild.
• Why Go for security — the crypto/* standard library tour.

Next: how the internet bootstraps trust between strangers — TLS & PKI.

Related topics