# Is AES-GCM suitable for per chunk encryption?

I was looking through Google's encryption flow and noticed that they split each file into chunks and then encrypt each chunk individually with AES-GCM with its own key.

Since AES-GCM starts to get vulnerable around $$2^{48}$$ messages (though, some people suggest $$2^{36}$$), how can they keep things secure if they have millions of users uploading files constantly?

I'm new to cryptography, so excuse my ignorance. Does the $$2^{48}$$ limit only actually matter on a per user basis or is it in general? I wanted to do try something similar using AES-CBC with a SecureRandom IV and HMAC for per chunk encryption since you don't have to worry about the collision. However, seeing their encryption flow, I wanted to learn more about what is the proper way of going about things.

• The limit is on a per-key and nonce basis. – forest Jul 25 '19 at 6:48
• Oh, so if you generate an entirely new key for each file, there is absolutely nothing to worry about. Sounds incredibly simple. – Mr_Antivius Jul 25 '19 at 7:53
• Yes. I've wrote an answer to summarize it. – forest Jul 25 '19 at 7:56