4
$\begingroup$

In The Galois/Counter Mode of Operation (GCM) by McGrew and Vega (PDF) it's stated that:

An initialization vector IV , that can have any number of bits between $1$ and $2^{64}$. For a fixed value of the key, each IV value must be distinct, but need not have equal lengths. 96-bit IV values can be processed mor e efficiently, so that length is recommended for situations in which efficiency is critical.

But how to choose the IV's size and how - if so - it affects the security of the algorithm?

$\endgroup$
6
$\begingroup$

But how to choose the IV's size and how - if so - it affects the security of the algorithm?

You really want to give 96-bit IVs to GCM (pad them if neccessary).

If you pick any IV size but 96-bit, GCM's polynomial hashing function GHASH is invoked to get the IV size down to 128-bit. This means that you basically apply a PRF on your IV, which means that there's a decent chance of hitting a collision if you use about $2^{64}$ IVs which will allow for a key-recovery attack on GCM and allows you to forge ciphertexts (numbers corrected by poncho).

NIST SP800-38D (PDF) has further treatment on the security considerations (especially with regards to IV sizes) in section 8. Furthermore it is the specific recommendation of NIST to use a 96-bit IV (section 5.2.1.1, found by Maarten):

For IVs, it is recommended that implementation restrict support to the length of 96 bits, to promote interoperability, efficiency, and simplicity of design.

| improve this answer | |
$\endgroup$
  • 2
    $\begingroup$ Correction: for an IV that's not exactly 96 bits long, it is GHASHed to a 128 bit value; that means that you would expect to get the first collision after about $2^{64}$ IVs $\endgroup$ – poncho Dec 19 '16 at 18:44
  • 1
    $\begingroup$ NIST also includes in 5.2.1.1: "For IVs, it is recommended that implementations restrict support to the length of 96 bits, to promote interoperability, efficiency, and simplicity of design." That also means that 96 bits is the only input value for which compatibility between libraries is reasonably guaranteed. Maybe you could include this in your answer. PS didn't find a dupe, strange, this question has come up before, maybe as a sub-question. $\endgroup$ – Maarten Bodewes Dec 20 '16 at 14:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.