AES-GCM has a limit on the length of the plaintext it encrypts: $2^{39} - 256$ bits. But is this limit per key or per (key, nonce)? That is, if I encrypt a message with the maximum length, and encrypt another message with the same key but different nonce, will it be secure still?
$\begingroup$
$\endgroup$
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
6
It is per message. I.e. per (key, nonce) -pair.
The reason it exists is that GCM uses CTR mode for encryption with (normally) a 32-bit counter. That means you can only encrypt $2^{32}$ blocks, i.e. $2^{39}$ bits with AES. The 256 bits that are subtracted are due to authentication.
So you can encrypt multiple maximum-length messages securely.
-
$\begingroup$ actually per spec there is a soft block limit of $2^{64}$ and a hard nonce limit of $2^{32}$ (if not using 96-bit IVs), whichever comes first $\endgroup$ Jan 11, 2016 at 10:53
-
$\begingroup$ @RichieFrame, good to know, but I guess that doesn't really change the answer? $\endgroup$– otusJan 11, 2016 at 11:12
-
$\begingroup$ @RichieFrame: What does the soft block limit mean? $\endgroup$ Jan 11, 2016 at 11:21
-
$\begingroup$ @SiyuanRen the soft block limit is a recommended maximum authenticated block count with a single key, soft because it is not a strict limit. Encrypting too many blocks or generating too many authentication tags can allow recovery of the hash subkey, and thus forging of new tags. $\endgroup$ Jan 11, 2016 at 21:06
-
$\begingroup$ @RichieFrame: What are those limit if the nounce if 96-bit? $\endgroup$ Jan 12, 2016 at 3:54