Skip to main content

AES-GCM Encrypt

AES-GCM Encrypt encrypts plaintext using AES in GCM mode and returns a single packed output containing:

IV + SALT + CIPHER_TEXT + TAG

If Generate Key is enabled, the step generates a random session key and salt, derives the AES key using PBKDF2, and writes the session key back to the message.

Parameters​

ITERATIONS​

Number of PBKDF2 iterations used when deriving the AES key.

Default: 65536

KEY_LENGTH​

Length (in bytes) of the derived AES key.

Default: 32

TAG_LENGTH​

Length (in bytes) of the AES-GCM authentication tag.

Default: 16

GENERATE_KEY​

When enabled, generates a random session key and salt, derives the AES key using PBKDF2, and writes the session key to KEY_PARAM.

When disabled, the step reads the AES key directly from the parameter named in KEY_PARAM (decoded using KEY_ENCODING).

Default: true

SESSION_KEY_LENGTH​

Length (in characters) of the generated session key (only used when GENERATE_KEY=true).

Default: 16

IV_LENGTH​

Length (in bytes) of the generated IV/nonce. For AES-GCM, 12 bytes is recommended.

Default: 12

SALT_LENGTH​

Length (in bytes) of the generated salt (only used when GENERATE_KEY=true).

Default: 16

RANDOM_FORMAT​

Format used for random values (IV, salt) and generated session key.

Supported values:

  • alnum (default)
  • bytes

Default: alnum

HASH_ALGORITHM​

Hash algorithm used by PBKDF2 while deriving the key.

Default: SHA256

KEY_ENCODING​

Encoding used for the session key / AES key input depending on GENERATE_KEY.

  • If GENERATE_KEY=true: used by the session key generator.
  • If GENERATE_KEY=false: used to decode the provided AES key into bytes.

Default: base64

IV_ENCODING​

Encoding used when generating IV bytes (implementation-dependent).

Default: utf8

SALT_ENCODING​

Encoding used when generating salt bytes (implementation-dependent).

Default: utf8

PLAIN_TEXT_ENCODING​

Encoding used to convert plaintext to bytes before encryption.

Default: utf8

CIPHER_TEXT_ENCODING​

Encoding used to convert the packed output bytes into the final ciphertext string.

Default: base64

KEY_PARAM​

Message parameter name used for the session key output (when GENERATE_KEY=true) or AES key input (when GENERATE_KEY=false).

Direction: InOut
Default: KEY

PLAIN_TEXT_PARAM​

Message parameter name that contains the plaintext input.

Direction: In
Default: PLAIN_TEXT

CIPHER_TEXT_PARAM​

Message parameter name that receives the packed ciphertext output.

Direction: Out
Default: CIPHER_TEXT

Execution Context Behavior​

  1. Reads plaintext from PLAIN_TEXT_PARAM and converts it to bytes using PLAIN_TEXT_ENCODING.
  2. Generates a random IV of IV_LENGTH.
  3. If GENERATE_KEY=true:
    • Generates a random salt of SALT_LENGTH.
    • Generates a random session key of SESSION_KEY_LENGTH.
    • Derives an AES key using PBKDF2 with ITERATIONS, HASH_ALGORITHM, and KEY_LENGTH.
    • Writes the session key into the message parameter named by KEY_PARAM.
  4. If GENERATE_KEY=false:
    • Reads the key from KEY_PARAM and decodes it using KEY_ENCODING to get the AES key bytes.
  5. Encrypts using AES-GCM producing CIPHER_TEXT bytes and TAG bytes.
  6. Packs the result as: IV + SALT + CIPHER_TEXT + TAG.
  7. Encodes the packed bytes using CIPHER_TEXT_ENCODING and writes to CIPHER_TEXT_PARAM.

Example Configuration​

ParameterValue
ITERATIONS65536
KEY_LENGTH32
TAG_LENGTH16
GENERATE_KEYtrue
SESSION_KEY_LENGTH16
IV_LENGTH12
SALT_LENGTH16
RANDOM_FORMATalnum
HASH_ALGORITHMSHA256
KEY_ENCODINGbase64
IV_ENCODINGutf8
SALT_ENCODINGutf8
PLAIN_TEXT_ENCODINGutf8
CIPHER_TEXT_ENCODINGbase64
KEY_PARAMKEY
PLAIN_TEXT_PARAMPLAIN_TEXT
CIPHER_TEXT_PARAMCIPHER_TEXT

Example Result​

KEY = [generated value]
CIPHER_TEXT = [base64 packed output]