AES-GCM has a limit on the length of the plaintext it encrypts: $2^{39} - 256$ bits. But is this limit per key or per (key, nonce)? That is, if I encrypt a message with the maximum length, and encrypt another message with the same key but different nonce, will it be secure still?


It is per message. I.e. per (key, nonce) -pair.

The reason it exists is that GCM uses CTR mode for encryption with (normally) a 32-bit counter. That means you can only encrypt $2^{32}$ blocks, i.e. $2^{39}$ bits with AES. The 256 bits that are subtracted are due to authentication.

So you can encrypt multiple maximum-length messages securely.

| improve this answer | |
  • $\begingroup$ actually per spec there is a soft block limit of $2^{64}$ and a hard nonce limit of $2^{32}$ (if not using 96-bit IVs), whichever comes first $\endgroup$ – Richie Frame Jan 11 '16 at 10:53
  • $\begingroup$ @RichieFrame, good to know, but I guess that doesn't really change the answer? $\endgroup$ – otus Jan 11 '16 at 11:12
  • $\begingroup$ @RichieFrame: What does the soft block limit mean? $\endgroup$ – Siyuan Ren Jan 11 '16 at 11:21
  • $\begingroup$ @SiyuanRen the soft block limit is a recommended maximum authenticated block count with a single key, soft because it is not a strict limit. Encrypting too many blocks or generating too many authentication tags can allow recovery of the hash subkey, and thus forging of new tags. $\endgroup$ – Richie Frame Jan 11 '16 at 21:06
  • $\begingroup$ @RichieFrame: What are those limit if the nounce if 96-bit? $\endgroup$ – Siyuan Ren Jan 12 '16 at 3:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.