For the AES-GCM mode within many cryptomodules, their FIPS-validation certificates list the options:

  • Payload Length: 504, 512, 1016, 1024
  • AAD Length: 0, 504, 512, 1016, 1024

For example in OpenSSL, "int aad_len" is the term for the 'AAD Length'.

What do these numbers refer to?

Are these maximum allowed, minimum allowed, or the exact length required for the payload (cyphertext) and additional authenticated data (AAD) (plaintext)? Do they refer to AES-GCM input or output? Is there a default (like with a 96-bit IV)?

As a newbie developer using AES-GCM what should I be concerned with picking / using these values? Does anyone have online references to these?

  • 1
    $\begingroup$ Could you supply the link to those FIPS validation certificates? Otherwise confusion may arise to what is meant here. $\endgroup$
    – Maarten Bodewes
    Jan 15 '20 at 17:54
  • $\begingroup$ • OpenSSL FIPS Object Module (cert 2473) -- csrc.nist.gov/projects/cryptographic-module-validation-program/… • Samsung SCrypto Library (cert 3200) • Samsung BoringSSL Cryptographic Module (cert 3354) $\endgroup$ Jan 16 '20 at 21:13
  • $\begingroup$ I really don't get it. The test vectors have different sizes, even if you take bits vs bytes into account (all values on the FIPS site seem to be in bits). Maybe they tested some specific sizes for their particular use case. I would simply ask NIST. They should have enough reason for their certificate program to be taken seriously, so I would expect them to answer. Feel free to ask them to answer here or provide a self answer, of course! $\endgroup$
    – Maarten Bodewes
    Jan 16 '20 at 22:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.