Why GCM operation mode with AES-128 is recomended and can we use AES-192 and AES-256 with GCM?

Question

It happens that on the internet I often find that AES encryption should use a 128-bit key only if it is used in conjunction with the GCM mode of operation.

Why only with 128-bit keys?

What happens if I use one of 192 or 256?

Can it be? Why is this recommendation made?

Answer 1

AES can be used with 128,192, and 256-bit key sizes and always with 128-bit block size ^†.

In NIST 800-38d, GCM is defined for 128-bit block size, since it is operating on block size and doesn't mandate about the key size.

This Recommendation specifies an algorithm called Galois/Counter Mode (GCM) for authenticated encryption with associated data. GCM is constructed from an approved symmetric key block cipher with a block size of 128 bits, such as the Advanced Encryption Standard (AES) algorithm that is specified in Federal Information Processing Standard (FIPS) Pub. 197

In rfc5288 these modes are defined for TLS 1.2

The following cipher suites use the new authenticated encryption modes defined in TLS 1.2 with AES in Galois Counter Mode (GCM)

• CipherSuite TLS_RSA_WITH_AES_128_GCM_SHA256 = {0x00,0x9C}
• CipherSuite TLS_RSA_WITH_AES_256_GCM_SHA384 = {0x00,0x9D}
• CipherSuite TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 = {0x00,0x9E}
• CipherSuite TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 = {0x00,0x9F}
• CipherSuite TLS_DH_RSA_WITH_AES_128_GCM_SHA256 = {0x00,0xA0}
• CipherSuite TLS_DH_RSA_WITH_AES_256_GCM_SHA384 = {0x00,0xA1}
• CipherSuite TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 = {0x00,0xA2}
• CipherSuite TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 = {0x00,0xA3}
• CipherSuite TLS_DH_DSS_WITH_AES_128_GCM_SHA256 = {0x00,0xA4}
• CipherSuite TLS_DH_DSS_WITH_AES_256_GCM_SHA384 = {0x00,0xA5}
• CipherSuite TLS_DH_anon_WITH_AES_128_GCM_SHA256 = {0x00,0xA6}
• CipherSuite TLS_DH_anon_WITH_AES_256_GCM_SHA384 = {0x00,0xA7}

and for TLS 1.3

• TLS_AES_256_GCM_SHA384
• TLS_CHACHA20_POLY1305_SHA256
• TLS_AES_128_GCM_SHA256
• TLS_AES_128_CCM_8_SHA256
• TLS_AES_128_CCM_SHA256

Can it be?

Yes, see above.

although AES-256-GCM is available, it is costly from the computational point of view at this time and should be used with other practices and methods to ensure greater security and privacy.

AES-256 is only 40% slower compared to AES-128. New CPU's from INTEL also includes instructions for GCM mode. If you are targetting post-quantum cryptography or fear of multi-target attacks on any 128-bit key sized block cipher you should use 256 bit key. Otherwise, 128 bit is fine [1],[2].

Why is this recommendation made?

Anybody can make recommendations. It is up to you to listen to them. Some already migrated to 256.

---

As commented by Swashbuckler, Department of Homeland Security, in section 5.1 of DHS Sensitive Systems Policy Directive 4300A Version 13.1 July 27, 2017 mandates 256-bit key size for block ciphers.

Systems requiring encryption comply with the following methods:

• Products using FIPS 197 Advanced Encryption Standard (AES) algorithms with at least 256 bit encryption that has been validated under FIPS 140-2
• National Security Agency (NSA) Type 2 or Type 1 encryption

If you want to sell a product that contains AES to them you need to use 256-bit.

---

_{^† Don't confuse AES with the Rijndael. From Wikipedia's footnotes;}

• Key sizes of 128, 160, 192, 224, and 256 bits are supported by the Rijndael algorithm, but only the 128, 192, and 256-bit key sizes are specified in the AES standard.
• Block sizes of 128, 160, 192, 224, and 256 bits are supported by the Rijndael algorithm for each key size, but only the 128-bit block size is specified in the AES standard.