int mbedtls_gcm_starts( mbedtls_gcm_context *ctx,
                int mode,
                const unsigned char *iv,
                size_t iv_len,
                const unsigned char *add,
                size_t add_len )
    int ret;
    unsigned char work_buf[16];
    size_t i;
    const unsigned char *p;
    size_t use_len, olen = 0;

    /* IV and AD are limited to 2^64 bits, so 2^61 bytes */
    if( ( (uint64_t) iv_len  ) >> 61 != 0 ||
        ( (uint64_t) add_len ) >> 61 != 0 )
        return( MBEDTLS_ERR_GCM_BAD_INPUT );

Above is a part of the implementation of GCM (Galois/Counter Mode) by mbedtls.

The implementation puts a restriction on the length of AAD (additional authenticated data), that is, the length of AAD cannot be greater than $2^{61}$ bytes.

My questions:

  1. Is there an actual limit on the length of AAD, or that's just an implementaion-specific restriction?
  2. Theoretically, can I input an AAD of any length?
  • $\begingroup$ Note that the security of GHash decays with increasing message length and becomes unacceptably weak long before you hit this hard limit. $\endgroup$ May 4, 2017 at 14:15
  • $\begingroup$ That's oy true for the message length and not the AAD length, correct? $\endgroup$
    – mat
    May 6, 2017 at 16:36
  • $\begingroup$ @mat That is incorrect. GHASH operates on both the additional data and the cipherext and it does so in the way for both. $\endgroup$
    – Melab
    Mar 12, 2018 at 0:25

1 Answer 1


From the GCM specification:

Additional authenticated data (AAD), which is denoted as A. This data is authenticated, but not encrypted, and can have any number of bits between $0$ and $2^{64}$ .


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.