AES-GCM has a limit on the length of the plaintext it encrypts: $2^{39} - 256$ bits. But is this limit per key or per (key, nonce)? That is, if I encrypt a message with the maximum length, and encrypt another message with the same key but different nonce, will it be secure still?


1 Answer 1


It is per message. I.e. per (key, nonce) -pair.

The reason it exists is that GCM uses CTR mode for encryption with (normally) a 32-bit counter. That means you can only encrypt $2^{32}$ blocks, i.e. $2^{39}$ bits with AES. The 256 bits that are subtracted are due to authentication.

So you can encrypt multiple maximum-length messages securely.

  • $\begingroup$ actually per spec there is a soft block limit of $2^{64}$ and a hard nonce limit of $2^{32}$ (if not using 96-bit IVs), whichever comes first $\endgroup$ Commented Jan 11, 2016 at 10:53
  • $\begingroup$ @RichieFrame, good to know, but I guess that doesn't really change the answer? $\endgroup$
    – otus
    Commented Jan 11, 2016 at 11:12
  • $\begingroup$ @RichieFrame: What does the soft block limit mean? $\endgroup$
    – Siyuan Ren
    Commented Jan 11, 2016 at 11:21
  • $\begingroup$ @SiyuanRen the soft block limit is a recommended maximum authenticated block count with a single key, soft because it is not a strict limit. Encrypting too many blocks or generating too many authentication tags can allow recovery of the hash subkey, and thus forging of new tags. $\endgroup$ Commented Jan 11, 2016 at 21:06
  • $\begingroup$ @RichieFrame: What are those limit if the nounce if 96-bit? $\endgroup$
    – Siyuan Ren
    Commented Jan 12, 2016 at 3:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.