# How to choose the size of the IV in AES-GCM?

In The Galois/Counter Mode of Operation (GCM) by McGrew and Vega (PDF) it's stated that:

An initialization vector IV , that can have any number of bits between $1$ and $2^{64}$. For a fixed value of the key, each IV value must be distinct, but need not have equal lengths. 96-bit IV values can be processed mor e efficiently, so that length is recommended for situations in which efficiency is critical.

But how to choose the IV's size and how - if so - it affects the security of the algorithm?

If you pick any IV size but 96-bit, GCM's polynomial hashing function GHASH is invoked to get the IV size down to 128-bit. This means that you basically apply a PRF on your IV, which means that there's a decent chance of hitting a collision if you use about $2^{64}$ IVs which will allow for a key-recovery attack on GCM and allows you to forge ciphertexts (numbers corrected by poncho).
• Correction: for an IV that's not exactly 96 bits long, it is GHASHed to a 128 bit value; that means that you would expect to get the first collision after about $2^{64}$ IVs Dec 19, 2016 at 18:44