CWC mode

In cryptography, CWC Mode (Carter–Wegman + CTR mode) is an AEAD block cipher mode of operation that provides both encryption and built-in message integrity, similar to CCM and OCB modes. It combines the use of CTR mode with a 128-bit block cipher for encryption with an efficient polynomial Carter–Wegman MAC with a tag length of at most 128 bits and is designed by Tadayoshi Kohno, John Viega and Doug Whiting.^[1]

CWC mode was submitted to NIST^[2] for standardization, but NIST opted for the similar GCM mode instead.^[3]

Although GCM has weaknesses compared to CWC,^[4] the GCM authors successfully argued for GCM.^[5]

CWC allows the payload and associated data to be at most 2³² - 1 blocks or nearly 550 GB.^[1]