1
$\begingroup$

I looked through NIST's official test vectors (CAVP) for the AES-GCM mode, and noticed that there are some test vectors in there with 8-bit or 1024-bit IVs. But as far as I understand, the GCM guideline specifically insists on using 96-bit IVs.

I took a glance at the SP 800-38D and found no clear guidelines on using these kinds of IVs. Section 8.2, which is dedicated to IV construction, says:

suppose that an implementation supports IV lengths of 64 bits, 96 bits, 128 bits, and 160 bits. For 64-bit IVs the only choice is the construction in Sec. 8.2.1. For the other three IV lengths, one possible combination of choices is the construction in Sec. 8.2.1 for 96-bit IVs and the construction in Sec. 8.2.2 for 128-bit and 160-bit IVs.

And section 8.2.2 mentions RBG-based Construction, but it gives no clear guideline on how exactly we are supposed to process a 1024-bit IV. I would appreciate a clear algorithmic guide for such IVs.

$\endgroup$
5
  • 1
    $\begingroup$ Does this answer your question? AES-GCM recommended IV size: Why 12 bytes? another How to choose the size of the IV in AES-GCM? $\endgroup$
    – kelalaka
    Commented Oct 2, 2022 at 8:22
  • $\begingroup$ @kelalaka : I read those questions before posting this. So I guess I wasn't paying enough attention and missed something. Can you point me to the phrase that answered this specific question? $\endgroup$
    – polfosol
    Commented Oct 2, 2022 at 8:39
  • $\begingroup$ It is in the NIST document, however, the first answer on the first link contains how IV is processed if it is not 12 bytes from the NIST doc. What is not clear there? $\endgroup$
    – kelalaka
    Commented Oct 2, 2022 at 8:43
  • $\begingroup$ @kelalaka yes, Danny did answer my question. What I meant was, you don't know it until you know it! $\endgroup$
    – polfosol
    Commented Oct 2, 2022 at 8:48
  • $\begingroup$ Another: How to choose the size of the IV in AES-GCM? $\endgroup$
    – kelalaka
    Commented Oct 3, 2022 at 22:18

1 Answer 1

5
$\begingroup$

The processing of non-96-bit IVs are specified in and as part of the GCM algorithm in section 7. And as anyone can tell, non-96-bit IVs are ultimately compressed to 96-bit, which means they're effectively 96-bit IVs, and this is why most guidelines recommends using only IVs of exactly 96 bits.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.