Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
In The Galois/Counter Mode of Operation (GCM) by McGrew and Vega (PDF) it's stated that:
An initialization vector IV , that can have any number of bits between $1$ and $2^{64}$. For a fixed value of the key, each IV value must be distinct, but need not have equal lengths. 96-bit IV values can be processed mor e efficiently, so that length is recommended for situations in which efficiency is critical.
But how to choose the IV's size and how - if so - it affects the security of the algorithm?
But how to choose the IV's size and how - if so - it affects the security of the algorithm?
You really want to give 96-bit IVs to GCM (pad them if neccessary).
If you pick any IV size but 96-bit, GCM's polynomial hashing function GHASH is invoked to get the IV size down to 128-bit. This means that you basically apply a PRF on your IV, which means that there's a decent chance of hitting a collision if you use about $2^{64}$ IVs which will allow for a key-recovery attack on GCM and allows you to forge ciphertexts (numbers corrected by poncho).
NIST SP800-38D (PDF) has further treatment on the security considerations (especially with regards to IV sizes) in section 8. Furthermore it is the specific recommendation of NIST to use a 96-bit IV (section 5.2.1.1, found by Maarten):
For IVs, it is recommended that implementation restrict support to the length of 96 bits, to promote interoperability, efficiency, and simplicity of design.
