Deciding on an AES cipher mode for chunked data I'm trying to decide on which ciphermode to use for a programming excercise. I have a file that I need to encrypt without saving unencrypted data to storage and without storing the entire file in memory.

I've opted for streaming the file, in a fixed size into a buffer, encrypting said buffer, write said buffer to storage and clear the buffer before doing it all again with the next slice of data.

Once the encrypted chunks had been written to storage, they could be consolidated into a single file, which would have to be split into chunks again for decryption.

The above seems like a standard way of doing it, from what I could gather, but I'm not entirely sure as to which ciphermode to use.

I was wondering which of AES-GCM and AES-CBC would be best to use?

Ideally I'd like to choose a solution that is "encrypt-then-mac", but I'm unsure which of those fit the bill here?

The programming language I'm doing this in is Golang, if that matters to anyone.
I was wondering which of AES-GCM and AES-CBC would be best to use?


If these two are your option, then it is essentially a no-brainer. Always use AES-GCM unless you really know what you are doing.


  Ideally I'd like to choose a solution that is "encrypt-then-mac", but
  I'm unsure which of those fit the bill here?


That's what AES-GCM does internally. It encrypts the data with AES-CTR and then uses a fast, specialized MAC to authenticate the ciphertext.


  Once the encrypted chunks had been written to storage, they could be
  consolidated into a single file, which would have to be split into
  chunks again for decryption.


One thing to look out for when doing streamed decryption is that the resulting plaintext must not be used until the decryption has finished. The reason being that until you have processed everything (including the authentication tag at the end), you can't be sure that the data hasn't been tampered with. There are workarounds to this, that allow you to chunk the data and authenticate it individually using incrementing nonces to prevent re-ordering attacks, but even then there may still be problems with substitution attacks (ie where old versions of chunks are used to substitute current chunks).