GCM is &quot;authenticated encryption&quot;. That means that it&#x27;s a cipher construction that provides both confidentiality and integrity, in one hermetically sealed capsule. Most legacy crypto (and most of the crypto in TLS) provides integrity checking as a separate operation; it will, for instance, take confidentiality from AES-CBC, and authentication from (say) HMAC-SHA1. This works fine, but requires that implementations do joinery between the cipher and the MAC.<p>Every iteration of TLS prior to the version that began providing authenticated encryption (of which GCM is the only widely compatible option) has gotten this joinery wrong.<p>There are workarounds for the resultant bugs, but it&#x27;s better, when possible, to enable the version of TLS that enables GCM, and prefer the GCM ciphersuites.