# What's the maximum length for AAD in GCM?

int mbedtls_gcm_starts( mbedtls_gcm_context *ctx,
int mode,
const unsigned char *iv,
size_t iv_len,
{
int ret;
unsigned char work_buf[16];
size_t i;
const unsigned char *p;
size_t use_len, olen = 0;

/* IV and AD are limited to 2^64 bits, so 2^61 bytes */
if( ( (uint64_t) iv_len  ) >> 61 != 0 ||
( (uint64_t) add_len ) >> 61 != 0 )
{
}
}


Above is a part of the implementation of GCM (Galois/Counter Mode) by mbedtls.

The implementation puts a restriction on the length of AAD (additional authenticated data), that is, the length of AAD cannot be greater than $2^{61}$ bytes.

My questions:

1. Is there an actual limit on the length of AAD, or that's just an implementaion-specific restriction?
2. Theoretically, can I input an AAD of any length?
• Note that the security of GHash decays with increasing message length and becomes unacceptably weak long before you hit this hard limit. May 4 '17 at 14:15
• That's oy true for the message length and not the AAD length, correct?
– mat
May 6 '17 at 16:36
• @mat That is incorrect. GHASH operates on both the additional data and the cipherext and it does so in the way for both. Mar 12 '18 at 0:25

Additional authenticated data (AAD), which is denoted as A. This data is authenticated, but not encrypted, and can have any number of bits between $0$ and $2^{64}$ .