RSA digital signature vs authenticated cipher I want to provide both confidentiality and integrity for data at rest (many large files stored on disk).

I plan to encrypt the data using AES, which will cover the confidentiality requirement.

So the issue is how to provide integrity:


Instead of AES, use AES-GCM-SHA256 (authenticated cipher). My understanding is that this produces an HMAC (keyed hash) of the encrypted data (and IV), and appends it to the end of the file
After encrypting each file, produce an RSA digital signature and either save it as a seperate file or append it to the encrypted file


What are the merits and disadvantages of each option?
You got some notation wrong. There is no algorithm like "AES-GCM-SHA-256".

AES is a block cipher, i.e. a pseudorandom permutation of 128-bit blocks. It itself only allows encryption for messages of size 128 bits (= 16 bytes), with a limited security guarantee.

When you mean "encrypt the data using AES", you actually mean "use AES with some mode of operation to encrypt the data".

Galois/Counter Mode is one such mode of operation, which combines counter mode for privacy and a block-cipher based MAC (GMAC) using some finite field operations and some block cipher calls for authentication.

SHA-256 is a hash function, but neither it nor its associated HMAC function HMAC-SHA-246 are used here in any way.

When using GCM (or almost any mode) for disk encryption with changing files, you should pay attention: You shall not use the same key and initialization vector (= initial counter) twice for different data. This also means, don't simply change some parts of the file an then encrypt again only the changed parts with same initialization vector, as you are then using the same IV twice (over time).

Instead, either generate a new random IV and encrypt the whole file with it, or split the file in blocks (of a comfortable size, e.g. 4 KB or such), each of which is then encrypted using GCM mode with a separate, independent random IV.
(This works better if you are encrypting your whole disk – then you would use the disk sector as your encryption unit.)

There is no point of using a signature – that only makes sense if you want to allow someone else to prove that you did produce (or at least sign) the data, without this one being able to produce it himself.